POLICY MANUAL FOR THE PROCESSING AND PROTECTION OF PERSONAL DATA ESCANDÓN ABOGADOS

PREAMBLE. – ESCANDÓN ABOGADOS, in compliance with the provisions of Law 1581 of 2012, and Regulatory Decree 1377 of 2013, implements its Policy Manual for the Processing and Protection of Personal Data. ESCANDÓN ABOGADOS will implement all the actions within its reach to comply with the protection and processing of the personal data which it is responsible for or in charge of, in particular in order to protect the rights to confidentiality, privacy, good name and the rights to know, update and rectify the data of the owners collected in their own databases of processed by order of third parties. That is why this manual applies both to protecting the personal data that are currently being processed and those that may be processed in the future, as well as for the processing the date of employees, suppliers and contractors. PRINCIPLES. – In the processing of personal data carried out by ESCANDÓN ABOGADOS, all the principles enshrined in Title II, Article 4 of the General Regime of Protection of Personal Data, Law 1581 of 2012 and the norms that develop and complement it, are applied. CONSULTATION OF THE POLICY OF PROCESSING PERSONAL DATA. This policy is available to the owners of the personal data by the appropriate means of disclosure that ESCANDÓN ABOGADOS, identified with Colombian Taxpayer ID NIT 900.909.688-4, puts at their disposal as the entity responsible or in charge of the processing of personal data and at its headquarters at Calle 87 No. 10 – 93 office 702 of the city of Bogota, phone 3904461, email mjescandon@escandonabogados.com PROCESSING OF PERSONAL DATA- The processing of personal data is done under the terms and scope of the authorization given by the owner or in application of the special rules when any legal exception to do so applies. RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA.- ESCANDÓN ABOGADOS acts as RESPONSIBLE for the processing of personal data by virtue of the collection it performs directly from the data of the holders, in order to provide legal advice and legal support, for which it has obtained the prior, informed and express consent of the data owners and those responsible for the processing of personal data, thus guaranteeing the rights of data protection. RIGHTS OF THE DATA HOLDER. – In accordance with the provisions of the current regulations applicable to data protection, the following are the rights of the holders of personal data: ▪ To access, to know, to update, to rectify and to suppress their personal data before ESCANDÓN ABOGADOS in their capacity as in charge of data processing. ▪ Request proof of the authorization granted by the holder of the data or by the person responsible for the processing of personal data to ESCANDÓN ABOGADOS for the processing of data, by any valid means. ▪ To be informed by ESCANDÓN ABOGADOS upon request, regarding the use that has been given to their personal data. ▪ Submit to the Superintendence of Industry and Commerce complaints for violations of the provisions of Law 1581 of 2012, after consultation or request with ESCANDÓN ABOGADOS. ▪ Revoke the authorization or request the deletion of the data when the Processing does not respect the principles, rights and constitutional and legal guarantees. ▪ Access without cost their personal data that have been the object of processing by ESCANDÓN ABOGADOS, as responsible or in charge of the processing of personal data. These rights may be exercised by: ▪ The holder of the personal data. ▪ The assignees of the holder of the personal data. ▪ The representative and/or proxy of the holder of the personal data. CONFIDENTIALITY AND SECURITY OF DATABASES. – ESCANDÓN ABOGADOS employs all the human, technical and technological resources that are within its reach, doing its utmost to provide security and confidentiality to the personal data which it is responsible for or in charge of the processing. Regarding confidentiality, ESCANDÓN ABOGADOS is committed to signing confidentiality agreements with third parties in the event agreements are entered into to share personal data for the provision of value-added services of a legal, commercial, loyalty, financial and services nature. AUTHORIZATION FOR THE USE OF PERSONAL DATA. – ESCANDÓN ABOGADOS as the RESPONSIBLE for the processing of personal data obtains the clear, prior, express and informed authorization without defects from the data holders, through forms, data collection forms, electronic forms and other means for this purpose. In the same way as the person IN-CHARGE of the data processing it will obtain the authorization of those responsible prior to the certification of the authorization of the holders granted them, within the agreement to share personal data. AUTHORIZATION AND CONSENT OF THE HOLDER. – ESCANDÓN ABOGADOS will request the authorization of the owners of the personal data and will inform the end purpose in advance for the processing of their personal data, except in the cases expressly authorized by law 1581 of 2012 in article 10. MEANS TO GRANT THE AUTHORIZATION .- ESCANDÓN ABOGADOS will obtain the authorization through different means, including physical and electronic documents, data message, the Internet, Websites, or any other form that in any case allows the consent of the holder through unequivocal conduct, by which it is concluded that if the holder or the person entitled to do so did not give said consent the data would not have been stored or captured in the database. The authorization will be requested by ESCANDÓN ABOGADOS prior to the processing of the personal information. REVOCATION OF THE AUTHORIZATION. – The owners of the personal data may at any time revoke the authorization given to ESCANDÓN ABOGADOS for the processing of their personal data or request the deletion or elimination of the same, provided it is not prevented by a legal or contractual provision. ESCANDÓN ABOGADOS will establish simple mechanisms that allow the holder to revoke their authorization or request the deletion of their personal data, at least by the same medium by which it was granted. For the above, it should be taken into account that the revocation of consent can be expressed in full in relation to the authorized purposes, and therefore ESCANDÓN ABOGADOS must cease any data processing activity of this data, and partially in relation to certain types of processing, in which case they will be the ones on which the processing activities will cease. In the latter case, ESCANDÓN ABOGADOS may continue processing personal data for those purposes for which the holder has not revoked their consent. GUARANTEES OF THE RIGHT OF ACCESS. – In order to guarantee the right of access of the data owner, ESCANDÓN ABOGADOS, will make available to the latter the respective personal data through any suitable means, including the electronic means that allow the holder direct access to them. PROCESSING TO WHICH THE DATA WILL BE SUBMITTED AND THE PURPOSE OF THE SAME.- The processing of the data of the holders with whom ESCANDÓN ABOGADOS has established a relationship as RESPONSIBLE, or that would establish a relationship as a Data Processing Manager, will be in order to provide legal advice and judicial support, and will perform it based on the requirements of law 1581 of 2012 and law 1266 of 2008, in what is applicable to it, and in general for the fulfillment of its corporate purpose. In any case, personal data may be collected and processed to: • Offer the holders the required legal counseling services. • Respond to judicial requirements, assistance and advice in legal proceedings and proceedings. • Provide commercial information, information on loyalty, and products and services in general, provided by ESCANDÓN ABOGADOS • Communicate information related to commercial campaigns, offers of valueadded services and its own products. • Develop the corporate purpose of ESCANDÓN ABOGADOS in accordance with its bylaws. • Consult consumer habits and hobbies for the offer of own services, or future partners. • Contact the data holders in order to carry out market studies. UPDATING DATABASES. – ESCANDÓN ABOGADOS will update its databases on a permanent basis, in accordance with the provisions of Law 1581 of 2012. PROCESSING OF DATA FOR CHILDREN AND ADOLESCENTS. – In the processing of personal data, ESCANDÓN ABOGADOS will ensure respect for the prevailing rights of minors (children, adolescents). In the event of them being collected, it will comply with the provisions of article 7 of Law 1581 of 2012. CONFIDENTIALITY NOTICE . – ESCANDÓN ABOGADOS has a confidentiality policy which is an integral part of this manual. TRANSFER OF DATA FOR PROCESSING BY NATIONAL AND INTERNATIONAL THIRD PARTIES. – ESCANDÓN ABOGADOS may transmit or transfer, in whole or in part, the personal data to third parties in the country or abroad, in the development of its corporate purpose, for which it requests authorization from its owner and implements the actions necessary to comply with the Legal precepts of Colombia, through the signing of agreements to share personal data. PROCEDURES.- The procedures described below can only be exercised by the owner, its successors-in-title or representatives, provided that the identity or representation is previously accredited. PROCEDURE FOR THE EXERCISE OF THE RIGHT OF PERSONAL DATA OWNERS.- In all procedures, the holder or their representatives must provide the following information: Name, last name, type of identification and number, Taxpayer ID NIT, citizenship card, address, telephone number and city, and a copy of the RUT (Unique Taxpayer Registration). PROCEDURE FOR CONSULTATION ON THE PROCESSING OF DATA BY ITS OWNERS. – ESCANDÓN ABOGADOS provides the appropriate means for the consultation, by the owners of the personal data, on the processing of their data, which will be informed within the forms or via email of personal data collection. Personal information. The terms to resolve queries are those indicated by law 1581 of 2012 art. 14. PROCEDURE FOR CORRECTING, UPDATING, RECTIFYING OR DELETING DATA. ESCANDÓN ABOGADOS, in compliance with the General Rules for the Protection of Personal Data, will proceed to correct, update, rectify or delete personal data at the request of the holder or their representative, under the terms indicated in the PROCEDURE FOR THE EXERCISE OF THE RIGHT OF PERSONAL DATA OWNERS. The procedure will be the one indicated in article 15 of the General Regime of Protection of Personal Data. ESCANDÓN ABOGADOS will train the managers to provide support for consultations and respond to complaints about the procedural procedure established by law. Paragraph. It will not accede to the request made by the owner or their representative on the deleting of the personal data, when there is a legal or contractual duty so that the personal data remains in the respective database. PROCEDURE TO REVOKE THE AUTHORIZATION GIVEN TO ESCANDÓN ABOGADOS TO PROCESS THE PERSONAL DATA. – The owner of the personal data or their representative can revoke the authorization given for the processing of their personal data by submitting a request addressed to the responsible for the processing or the person in charge of the same in accordance with the PROCEDURE FOR THE EXERCISE OF THE RIGHT OF THE PERSONAL DATA HOLDERS. GUARANTEES OF THE RIGHT OF ACCESS. – ESCANDÓN ABOGADOS guarantees the right of access to the data holder, making available to the latter, at no cost, in a detailed way, the respective personal data by the means suitable for this purpose. TERM OF THE POLICY.- This is in effect from the date of its publication and render the other institutional dispositions that are contrary to it completely void. What is not foreseen in this manual will be regulated according to the General Regime on the Protection of Personal Data in force in Colombia.