PROTECTION AND DATA PROCESSING POLICY IN TRIANA, URIBE & MICHELSEN LTDA

In accordance with the Political Constitution of Colombia, Law 1581 of 2012, Regulatory Decree 1074 of 2015, and other complementary regulations, this Personal Data Protection and Processing Policy (hereinafter referred to as the “POLICY”) establishes how TRIANA, URIBE & MICHELSEN LTDA. (hereinafter referred to as “TUM”), a properly established commercial society in Colombia, identified with the NIT 830.001.432 – 4, located in the city of Bogotá, D.C. and with offices at Calle 93B No. 12 – 48 P. 4, email address protecciondatos@tumnet.com and telephone number (57 1) 601 96 60, collects and processes your personal data (hereinafter referred to as the “Personal Data”).

Definitions

For the interpretation of the POLICY, we ask you to consider the following definitions:

• Authorization: Express, unequivocal and informed consent of the Data Owner to carry out the processing of their personal information.
• Database: any organized set of data that is subject to processing.
• Personal data: any information linked or that can be associated with one or more specific or determinable natural persons (hereinafter “personal data” or “personal information”).
• Public data: Those data that are not semi-private, private or sensitive. Data relating to a person’s marital status, profession or trade, and status as a merchant or public servant are considered public data, among others.
• Semi-private data: Data that does not have an intimate, confidential, or public nature and whose knowledge or dissemination may be of interest not only to its owner but also to a certain sector or group of people or to society in general, such as financial and credit data for commercial or service activities.
• Sensitive data: those data that affect the intimacy of the Owner or whose improper use can generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life and biometric data.
• Data Processor: natural or legal person, public or private, that by itself or in association with others, carries out the Processing of Personal Data on behalf of the Data Controller.
• Data Controller: natural or legal person, public or private, that by itself or in association with others, decides on the Database and/or Processing of data.
• Data Owner: natural person whose Personal Data is subject to Processing.
• Data Transmission: Processing of Personal Data that involves communicating the same within or outside the territory of the Republic of Colombia when the purpose is to carry out a Processing by the Processor on behalf of the Data Controller.
• Data Transfer: Data transfer takes place when the Data Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is the Data Controller and is located within or outside the country.
• Processing: Any operation or set of operations on personal data, including but not limited to, collection, storage, use, circulation or suppression.

2. Personal data that we collect and process

In order to comply with the obligations and activities described in section 3 of the POLICY, TUM directly collects the following data, which are non-sensitive Personal Data:

• Name, identification number, address, phone, physical or postal address, email, contact information, position within the company where you work, salary, marital status, Unique Tax Identification Number (RUT) and in the same way, your personal image may be captured through cameras installed in TUM’s offices when you visit our facilities.
• Information that is sent to us or consulted through databases of universities, websites, or social networks such as LinkedIn, ElEmpleo.com, among other means where you have included your Personal Data.
• Financial information when it is necessary to make a payment or present a bill, including the number of your bank accounts, banks where you have your accounts, bank and commercial references.
• Other data that is required for the normal development of your commercial or contractual relationship with TUM.

3. Treatment to which your Personal Data will be subject

TUM will process your Personal Data, that is, with respect to them, it will carry out activities such as collection, storage, use, circulation or suppression, in order to fulfill the normal development of the object of our company and our relationship with you. Within this purpose, we will process your Personal Data for:

3.1. Processing of Personal Data prior to the start of an employment relationship

The purposes of the processing of the Personal Data provided by those interested in participating in a selection process and the personal information obtained in said process are limited to: (i) the collection, classification, storage, use and archiving of personal data; (ii) the delivery of the information to third parties in charge of selection processes; (iii) the verification, comparison, evaluation of the job and personal competencies of the prospects regarding TUM’s selection criteria; (iv) keeping a record of the candidates who applied and those who were discarded in the selection process; v) scheduling interviews and administering tests to applicants; vi) evaluating the selection tests directly or through third parties; vii) reporting the overall results of the selection process; (viii) consulting and evaluating all the information about the applicant that is stored in legally established judicial or security databases, of a state or private nature, national or foreign.

3.2. Processing of Personal Data during the term of an employment relationship

The purposes of the processing of the Personal Data provided by TUM’s employees are limited to: (i) the collection, classification, storage, archiving of personal data; (ii) compliance with the obligations derived from the labor contract entered into with the Data Owner; (iii) compliance with legal obligations in the area of social security and non-tax contributions; (iv) processing of incapacities, permits or licenses; (v) providing information to judicial and administrative authorities, when judicial and/or administrative orders are issued in that sense; (vi) delivering information to internal or external auditors, attorneys and potential investors or buyers in case of sale of the company or the inclusion of new shareholders, if required; (vii) delivering information to third parties that are verifying work references; (viii) issuing employment certificates; (ix) complying with all the obligations derived from the contractual relationship and its termination; (x) the normal development of the contractual relationship.

3.3. Processing of Personal Data of suppliers

The purposes of the processing of personal data provided by TUM’s suppliers are: (i) to collect, store and classify the information provided by suppliers for the proper management of the commercial relationship; (ii) to comply with the legal and contractual obligations derived from the commercial relationship; (iii) to contact the supplier; (iv) to make the corresponding payments; (v) to keep records of the commercial transactions; (vi) to evaluate the supplier’s performance; (vii) to resolve claims or disputes that may arise; (viii) to provide information to internal or external auditors, attorneys and potential investors or buyers in case of sale of the company or the inclusion of new shareholders, if required; (ix) to comply with all the obligations derived from the contractual relationship and its termination; (x) the normal development of the commercial relationship.

3.4. Treatment of customer personal data

The purposes of the treatment of personal data provided by TUM’s customers are: (i) to have the personal information provided by our customers at the time of signing contracts, in order to comply with the obligations derived from them; (ii) to present offers and quotations; (iii) to carry out evaluations and/or surveys related to the level of satisfaction of our customers in relation to the products and services we offer and provide; (iv) to carry out analysis and customer profiling that allows us to define products and services that meet their needs; (v) to send legal and commercial communications related to the products and services we offer and provide; (vi) to carry out market research and consumption habits, statistical analysis and customer behavior reports; (vii) for the normal development of the contractual relationship.

3.5. Treatment of Financial Personal Data:

TUM will only process your Financial Personal Data when this information is necessary to carry out billing, portfolio, collection and payment processes for the products and services provided by and/or for TUM, and for the sending of invoices either electronically, physically or by any means agreed upon with you and in the cases previously established in this POLICY.

3.6. Treatment of Personal Data of Minors:

In compliance with the law, TUM will proceed to carry out the Processing of Personal Information of children, respecting their best interest and ensuring, in all cases, respect for their fundamental rights and minimum guarantees.

In all events in which it is necessary to process Personal Information of minors, TUM will obtain the Authorization of their legal representatives, who for this purpose are father and/or mother or guardian.

3.7. General

TUM collects your Personal Data through various information sources such as personal or work electronic messages, through the website www.tumnet.com or physical correspondence, by existing information in TUM’s databases according to the procedure established in Decree 1377 of 2013, in its article 10, through voice messages, information archived on computers and electronic devices of TUM, fax systems, internet access, correspondence or through any other electronic device for communications and any other technological resource.

TUM will only use personal data within the use that you have authorized, and will only transmit it to customers or third parties when necessary as a result of TUM’s ordinary operations and to judicial and administrative authorities when required by a judicial or administrative order. TUM will protect and safeguard the personal data received at its address, limiting its use and disclosure to the authorized purpose.

4. Your rights as the holder of personal data

In accordance with article 8 of Law 1581 of 2012, TUM informs you that you have the following legal rights:

• To know, update and correct your personal data with TUM. This right can be exercised, among others, in relation to information that is partial, inaccurate, incomplete, divided, misleading or whose treatment is prohibited or not authorized.
• To require proof of the consent given to TUM for the collection and treatment of your personal data, and to have access to your personal data that is being processed by TUM.
• To revoke the authorization given to TUM and/or request the deletion of your personal data when you consider that TUM is not respecting the constitutional and legal principles, rights and guarantees. In these cases, TUM will inform you about the implications that the revocation of the authorization or the deletion of your personal data may have on the database.
• To have access to the personal data that TUM has collected and processed.
• If you are not satisfied with the way TUM handles your personal data or have any complaints or claims, you may submit a statement to TUM’s data protection officer at the email address protecciondatos@tumnet.com
• If TUM’s data protection officer does not resolve your concerns or attend to your complaint, you may address the Personal Data Delegation of the Superintendency of Industry and Commerce to present your concerns, complaints or claims if you believe that TUM has violated your habeas data rights or the provisions of Law 1581 of 2012, Decree 1074 of 2015 and other regulations that modify, add or complement them.

5. Persons or area responsible for responding to inquiries, requests or complaints related to the treatment of your personal data

If you have any questions, inquiries or complaints related to your personal data, you can contact the TUM Data Protection Officer at the email address protecciondatos@tumnet.com (hereinafter the “Data Protection Officer”). You can exercise your right to know, update, rectify or delete your personal data and revoke the consent given to TUM for the treatment of your personal data before this person or area of TUM.

6. TUM’s security policy

TUM takes effective, appropriate and reasonable measures to protect your personal data from loss, misuse, unauthorized access, disclosure, alteration and destruction.

7. Procedure for exercising your rights

Any question or inquiry regarding your personal data collected and processed by TUM, will be received by the TUM Data Protection Officer, for which you should send a written description of your inquiry to the email address protecciondatos@tumnet.com.

The TUM Data Protection Officer will resolve your question or inquiry within ten (10) business days from the date the question or inquiry is received. If it is not possible for the TUM Data Protection Officer to respond to your claim within the aforementioned term, the TUM Data Protection Officer will let you know the situation and explain the reason for the delay. In any case, the TUM Data Protection Officer will respond to you within five (5) business days following the expiration of the initial ten (10) business days term.

The consent given by you may be revoked at any time, by means of prior notice, written and signed, addressed to the TUM Data Protection Officer, at the aforementioned electronic address, in the terms established by the Law.

If you consider that the information contained in TUM’s database is subject to correction, updating or deletion, or if you consider that TUM is not complying with its obligations established in Law 1581 of 2012, you must file a complaint with TUM, addressed to the Data Protection Officer, which will be treated according to the procedure established in article 15 of Law 1581 of 2012.

8. Effective date of the Policy and expiration date of the database.

This Policy will go into effect on July 1, 2017 and your Personal Data will remain in TUM’s database until it serves the purpose for which it was collected, or the specified time period ends as required by law.