Personal Data Processing Policy

Law 1581 of 2012, partially regulated by Decree 1377 of 2013, aims to develop the constitutional right that all individuals have to know, update, and correct the information collected about them in databases or records, as well as the other rights, freedoms, and constitutional guarantees referred to in Article 15 of the Political Constitution, and the right to information established in Article 20 of the same Charter.

In compliance with the provisions of Law 1581 of 2012, which establishes regulations for the protection of personal data, 150 Por Ciento SAS, in its capacity as the data controller, sets forth the general policies to be followed:

1.1 Identification of the Personal Data Controller

The Data Controller is 150 Por Ciento SAS, identified with NIT 900.901.834-7, with its registered office at Carrera 7 A 150-36, Office 304, in the city of Bogotá.

Contact:

• Physical address: Carrera 7 A 150-36, Office 304, Bogotá – Administrative Office.
• Email: [email protected]
• Phone: +57 312 494 86 93

The departments and work areas of the company, depending on the type of information they handle in the performance of their duties, are in charge of processing personal data.

OBJECTIVE

To establish the data processing policy of 150 Por Ciento SAS for the proper protection of the rights of users, visitors, and others who provide their personal data to the company through various service channels and information collection methods.

SCOPE

This data protection policy applies to all employees, suppliers, and external personnel who have access to the personal data collected by 150 Por Ciento SAS. It also applies to all information defined as personal data registered in databases, information files, or any storage medium held by 150 Por Ciento SAS that is covered under Law 1581 of 2012.

OBLIGATIONS

All employees, contractors, personnel working at the facilities of 150 Por Ciento SAS or remotely, suppliers, or external personnel who collect, store, use, circulate, or delete personal data must be aware of and comply with this policy.

DEFINITIONS

The definitions established in Article 3 of Law 1581 of 2012 and other related regulations shall apply. Below are some key definitions:

• Authorization: Prior, express, and informed consent of the data subject for the processing of personal data.
• Privacy Notice: Verbal or written communication to inform the data subject about the existence of data processing policies.
• Personal Data: Information that can be associated with one or more identified or identifiable natural persons.
• Public Data: Information that is not semi-private or private.
• Sensitive Data: Data that affects the privacy of the data subject or whose misuse may result in discrimination.

GENERAL PRINCIPLES FOR PERSONAL DATA PROCESSING

The principles established by Law 1581 of 2012 shall be applied harmoniously and integrally. Some of these principles include:

• Principle of Legality: The collection, use, and processing of personal data shall be based on what is established by law and its provisions.
• Principle of Purpose: The collection and processing of personal data shall serve a legitimate purpose, which shall be informed to the data subject.
• Principle of Freedom: Processing may only be carried out with the consent of the data subject.
• Principle of Truthfulness or Quality: Personal data must be truthful, complete, accurate, up-to-date, and verifiable.
• Principle of Security: Technical, human, and administrative measures will be adopted to protect personal data.
• Principle of Confidentiality: Those involved in the data processing are required to ensure the confidentiality of the information.

PERSONAL DATA PROCESSING

Users, visitors, and any person who provides their personal data to 150 Por Ciento SAS do so voluntarily to access the company’s services. 150 Por Ciento SAS will only use personal data to fulfill its functions and will not share such data with third parties without the express authorization of the data subject.

COMPLIANCE WITH INTERNATIONAL LEGISLATION

150 Por Ciento SAS ensures that, in addition to complying with Colombian law, it adheres to applicable international regulations, such as the General Data Protection Regulation (GDPR) of the European Union and the California Consumer Privacy Act (CCPA), where applicable. We are committed to protecting the privacy of all our users, regardless of their geographic location.

ENTITIES TO WHOM 150 POR CIENTO SAS MAY PROVIDE INFORMATION

Personal data may be provided to:

• The data subjects or their legal representatives.
• Public or administrative entities in the exercise of their legal functions or by court order.
• Third parties authorized by the data subject or by law.

PROCESSING AND PURPOSE

The processing carried out by 150 Por Ciento SAS will include:

• Management of in-person or virtual services.
• Sending information related to services, promotional activities, and market analysis.
• Management of business relationships and recruitment processes.
• Compliance with contractual and legal obligations.

RIGHTS OF DATA SUBJECTS

Data subjects have the right to:

• Access, update, and correct their personal data.
• Request the deletion of data when the principles established by Law 1581 of 2012 are not respected.
• File complaints with the Superintendence of Industry and Commerce.

DUTIES OF THE DATA CONTROLLER

150 Por Ciento SAS guarantees:

• The full exercise of the right to habeas data.
• The security of personal data and the correction of any incorrect information.
• Compliance with instructions issued by the Superintendence of Industry and Commerce.

HANDLING OF INQUIRIES AND CLAIMS

Inquiries will be addressed via email at [email protected] within a maximum of 10 business days. Claims, in accordance with Article 15 of Law 1581 of 2012, will be resolved within a maximum of 15 business days.

SECURITY

150 Por Ciento SAS is committed to making appropriate use of personal data and implementing security measures to prevent unauthorized access.

VALIDITY AND POLICY CHANGES

This policy has been in effect since June 1, 2018. 150 Por Ciento SAS reserves the right to modify it at any time, with updates published on our website.

APPLICABLE LAW AND JURISDICTION

This policy is governed by the laws of the Republic of Colombia. Any legal dispute will be resolved before the competent courts in Colombia.