Policy for the Processing of Personal Data

PERSONAL DATA PROCESSING POLICY

Our Company informs the Holders of Personal Data that may be processed in any way by the company about this information processing policy, thereby complying with the Law. The main purpose of this Policy is to inform the Holders of Personal Data of their rights, the procedures and mechanisms provided by the company to enforce those rights, and to make them aware of the scope and purpose of the Processing to which their Personal Data will be subjected in case the Holder gives prior, express, and informed authorization. The company also reaffirms its commitment to the various stakeholders with whom it relates, and its explicit interest in respecting all their rights, especially through this instrument their right to Habeas Data, privacy, and related rights.

CHAPTER I

General Provisions

ARTICLE ONE: DEFINITIONS. The following definitions refer to the meaning that must be given to the terms within this document:

a) Authorization: The prior, express, and informed consent of the Holder to carry out the Processing of their personal data.

b) Database: The set of personal data that are subject to Processing regardless of its modality.

c) Financial Data: All Personal Data related to the creation, execution, and termination of monetary obligations, regardless of the nature of the contract that gave rise to them, whose Processing is governed by the applicable regulations.

d) Personal Data: Any information related or relatable to a natural person.

e) Public Data: Data that the law declares as such, or that rests in public records, certificates, documents, or Databases.

f) Sensitive Data: Personal data related to the Holder’s privacy or that may give rise to discrimination or differential treatment. Biometric data are also part of this category.

g) Processor: A natural or legal person, public or private, who, alone or jointly with others, processes Personal Data on behalf of the Data Controller.

h) Authorized: A person and their dependents who, by virtue of the Authorization and this Policy, have legitimacy to Process the Holder’s Personal Data.

i) Authorization Grant: The legitimacy expressly granted in writing, by contract or equivalent document, by the Company to third parties, in compliance with applicable law, for the Processing of Personal Data, making such third parties Processors.

j) Data Controller: The person, authorized by the Holder, who manages and makes decisions regarding the Database.

k) Holder: The natural person to whom the data contained in the Database refers and who is the object of protection by law and related regulations.

l) Transfer: The communication of personal data between the Processor and the Controller.

m) Transmission: The Processing activity by which Personal Data is communicated, internally or with third parties, within or outside the country, when such communication aims to carry out any Processing activity.

n) Personal Data Processing: Any activity aimed at processing Databases, including their transfer to third parties.

ARTICLE TWO: PURPOSE. This Policy establishes the procedure to collect, store, use, and carry out any activity related to personal data, as well as the rights, freedoms, and constitutional guarantees, including the right to information, as stipulated by law.

ARTICLE THREE: COMPLIANCE WITH LEGAL PROVISIONS. The Company declares that the guidelines for Personal Data Processing will be those provided by current applicable laws.

ARTICLE FOUR: PURPOSES OF THE DATA COLLECTED. All data collected by the Company is aimed at:
i) Managing all information required for compliance with tax, commercial, civil, labor, legal, and other obligations.
ii) Managing relationships with clients, suppliers, shareholders, and other stakeholders. This includes financial services, customer loyalty, customer service, marketing, correspondence, call center, real estate offers, data updates, partner information, administrative and advertising purposes, etc.
iii) Complying with legal and contractual obligations.
iv) Verifying the legal status of clients, contractors, or suppliers.
v) Keeping records (physical or digital) for the legally required period.
vi) Transferring and transmitting Databases when necessary for collections, credit processes, lawsuits, or other related purposes.
vii) Managing employee information regarding payroll, social security, hiring, and wellbeing.
ix) Any other activities necessary for the effective provision of the company’s services.

ARTICLE FIVE: PRINCIPLES. The following principles guide the collection, storage, use, and management of personal data:

• Legality: Processing is a regulated activity subject to law.

• Purpose: Processing must follow the purposes stated in Article Four.

• Freedom: Processing requires prior, express, and informed consent, except when a legal or judicial mandate exists.

• Accuracy: Data must be true, complete, accurate, updated, verifiable, and understandable.

• Transparency: The Holder has the right to obtain information at any time about the existence of their data.

• Restricted Access and Circulation: Data Processing may only be carried out by the company or its delegates. Data cannot be publicly available.

• Security: The company will implement physical and digital security measures to protect data.

• Confidentiality: Personal data will be confidential unless otherwise authorized or legally required.

CHAPTER II

Rights and Duties

ARTICLE SIX: RIGHTS OF THE HOLDER. Holders have the right to:

• Know, update, and rectify their data.

• Request proof of authorization.

• Request information about the use of their data.

• File complaints with competent authorities.

• Revoke authorization and/or request deletion of their data when applicable.

• Access their data free of charge.

• Be informed of changes to this Policy.

• Access this Policy and their data easily.

• Know the designated person or department for data-related requests.

These rights may be exercised directly, or through legal representatives, heirs, or guardians, with proper documentation.

ARTICLE SEVEN: DATA CONTROLLER AND PROCESSOR. The Company is both Controller and Processor of the data. It may delegate internally but remains responsible for:

• Handling and responding to requests for updates, access, deletion, or authorization proof.

• Informing Holders when requests do not proceed according to law.

CHAPTER III

Procedures

ARTICLE EIGHT: HOLDER PROTECTION MECHANISMS.

8.1. Inquiries: Holders may inquire about their data. The company must respond within 10 business days, extendable to 15 with proper notice.

8.2. Claims: Holders may file claims to correct, update, or delete data, or for noncompliance by the Company. Claims must include identification, description of facts, contact details, and supporting documents.

• Incomplete claims will require correction within 5 days; failure to do so within 2 months will be deemed withdrawn.

• Once admitted, the company will mark the data as “claim in process” within 2 business days.

• Claims must be resolved within 15 business days, extendable by 8 days with notice.

EFFECTIVE DATE. This Policy is effective from July 1, 2017. Personal data collected will remain in the Company’s Database for as long as necessary to fulfill the purposes outlined herein.