Personal data processing and protection policy

PERSONAL DATA PROCESSING AND PROTECTION POLICY ALZATE BLAIR ABOGADOS S.A.S.

This PERSONAL DATA PROCESSING AND PROTECTION POLICY (hereinafter, the “Policy”) of ALZATE BLAIR ABOGADOS S.A.S., identified with Tax Identification Number (NIT) 900.825.714-6 (hereinafter, the “Company”), is intended to inform Data Subjects of the Processing applicable to the Personal Data held in its Databases, the rights available to Data Subjects with respect to such Personal Data, and the mechanisms available to exercise those rights.

This Personal Data Processing Policy has been prepared in accordance with the applicable constitutional, statutory, and regulatory provisions, particularly Articles 15 and 20 of the Political Constitution of Colombia, Law 1582 of 2012, “Whereby general provisions are established for the protection of personal data,” Decree 1377 of 2013, “Whereby Law 1582 of 2012 is partially regulated,” and any other supplementary provisions that amend or add to them.

DEFINITIONS

For purposes of this Policy, the following terms shall have the meanings set forth below:

Authorization: The Data Subject’s prior, express, and informed consent to the Processing of Personal Data.
Privacy Notice: A verbal or written communication issued by the Data Controller and addressed to the Data Subject in connection with the Processing of Personal Data, informing the Data Subject of the existence of the applicable information processing policies, how to access them, and the purposes for which the Personal Data will be Processed.
Database: An organized set of Personal Data subject to Processing.
Disclosure / Assignment of Data: Any disclosure of Personal Data to a person or entity other than the Data Subject. Except where legally permitted otherwise, the disclosure or assignment of Personal Data must be authorized by the Data Subject. Accordingly, Personal Data shall not be disclosed to other individuals or legal entities unless the Data Subject has given consent or an exception provided by law applies.
Unequivocal Conduct: Conduct from which it may reasonably be concluded that the Data Subject granted Authorization for the Processing of Personal Data.
Personal Data: Any information linked or that may be associated with one or more identified or identifiable natural persons.
Private Data: Data that, due to its intimate or confidential nature, is relevant only to the Data Subject.
Public Data: Data classified as public pursuant to the law or the Political Constitution of Colombia, as well as any data that is not classified as semi-private or private under applicable law. Public Data includes, among other information, data relating to an individual’s civil status, profession or occupation, and status as a merchant or public servant. Due to its nature, Public Data may be contained, among other sources, in public records, official gazettes and bulletins, and final court judgments that are not subject to confidentiality restrictions.
Semi-Private Data: Data that is neither intimate, confidential, nor public in nature and whose knowledge or disclosure may be of interest not only to the Data Subject but also to a particular sector or group of persons or to companies generally, such as financial and credit information concerning commercial or service activities, in accordance with applicable regulations.
Sensitive Personal Data: Data that affects the Data Subject’s privacy or whose improper use may result in discrimination, including data revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, trade union membership, membership in social or human rights organizations or organizations promoting the interests of any political party or safeguarding the rights and guarantees of opposition political parties, as well as health information, information concerning sex life, and biometric data.
Data Processor: A natural person or legal entity, whether public or private, that, acting independently or jointly with others, Processes Personal Data on behalf of the Data Controller.
Purpose: The specific objective for which the Personal Data collected and subject to Processing will be used.
Data Controller: A natural person or legal entity, whether public or private, that, acting independently or jointly with others, makes decisions regarding the Database and/or the Processing of Personal Data.
Data Subject: The natural person whose Personal Data is subject to Processing.
Transfer: A Transfer of Personal Data occurs when a Data Controller and/or Data Processor located in Colombia sends information or Personal Data to a recipient located outside Colombia that, in turn, acts as a Data Controller.
Transmission: Processing of Personal Data involving the communication of such data within or outside Colombian territory for the purpose of allowing a Data Processor to Process the Personal Data on behalf of the Data Controller.
Processing: Any operation or set of operations performed on Personal Data, including collection, storage, use, circulation, or deletion.
User: Any person or process authorized by the Data Controller to access resources containing Personal Data.

PRINCIPLES GOVERNING THE PROCESSING OF PERSONAL DATA

In the interpretation and application of Law 1581 of 2012, which establishes general provisions governing the protection of Personal Data, and any regulations supplementing, amending, or adding thereto, the following principles shall apply harmoniously and comprehensively:

Principle of Access and Restricted Circulation: Processing shall be subject to the limitations arising from the nature of the Personal Data, applicable regulations, and the principles governing the administration of Personal Data, particularly the principles concerning the duration for which information may be retained and the purposes of Processing.

Except for Public Data, Personal Data may not be made available on the internet or through other mass communication or dissemination channels unless access is technically controlled so that the information is available only to Data Subjects or authorized users in accordance with applicable regulations.

Principle of Confidentiality: All natural persons or legal entities involved in the administration of Personal Data that is not Public Data shall at all times maintain the confidentiality of such information, including after the termination of their relationship with any activity involving the administration of Personal Data. Personal Data may only be supplied or disclosed where such disclosure is authorized by law and in accordance with the terms thereof.
Principle of Purpose Limitation: The administration of Personal Data must serve a legitimate purpose in accordance with the Constitution and the law. The purpose must be disclosed to the Data Subject before or at the time Authorization is granted, whenever Authorization is required, or whenever the Data Subject requests information regarding such purpose.
Principle of Lawfulness: Processing is a regulated activity and must comply with applicable law and the regulations implementing it.
Principle of Freedom: Processing may only be carried out with the Data Subject’s prior, express, and informed consent. Personal Data may not be obtained or disclosed without prior Authorization, except where a statutory or judicial mandate allows otherwise.
Principle of Security: Information subject to Processing shall be managed using the technical, human, and administrative measures necessary to safeguard the records against alteration, loss, unauthorized or fraudulent consultation, use, or access.
Principle of Transparency: Processing must guarantee the Data Subject’s right to obtain from the Data Controller or Data Processor, at any time and without restriction, information regarding the existence of Personal Data concerning them.
Principle of Accuracy or Data Quality: Information contained in Databases must be truthful, complete, accurate, up to date, verifiable, and understandable. The recording and disclosure of partial, incomplete, fragmented, or misleading data is prohibited.

DATA CONTROLLER INFORMATION

The Company shall be responsible for the collection and Processing of Personal Data, the corresponding Authorizations, and stored records, and shall take appropriate measures to prevent their deterioration, loss, alteration, or unauthorized use and to maintain them under appropriate security conditions.

The customer service area shall be responsible for handling petitions, complaints, and inquiries submitted by Data Subjects. Data Subjects may exercise their rights to access, update, rectify, and delete their Personal Data through the following channels:

Email: [email protected]
Physical address: Carrera 43B No. 16-95, Office 911, Medellín, Antioquia.
Telephone: (604) 408 4248.

PURPOSES OF PROCESSING

Personal Data collected by the Company shall be Processed in accordance with applicable Colombian law and the Authorizations granted by Data Subjects, as applicable, for the following purposes:

To manage and respond to requests, inquiries, petitions, complaints, claims, requirements, and other communications submitted by Data Subjects through the channels made available by the Company.
To establish, develop, maintain, administer, and manage commercial, contractual, civil, professional, employment, or other relationships maintained by the Company with Data Subjects.
To provide, manage, coordinate, and monitor legal services requested, retained, or acquired by Data Subjects.
To analyze, handle, and manage legal inquiries, advisory matters, legal opinions, judicial, administrative, arbitral, conciliation, extrajudicial, and other legal matters entrusted to the Company.
To manage legal matters and files handled by the Company, including the collection, organization, updating, consultation, analysis, storage, custody, and preservation of information necessary for their proper handling.
To carry out proceedings, actions, applications, communications, filings, submissions, and other activities required before judicial and administrative authorities, supervisory and regulatory bodies, conciliation centers, arbitral tribunals, public or private entities, and other third parties involved in matters entrusted to the Company.
To manage information relating to clients, prospective clients, parties, counterparties, legal representatives, attorneys-in-fact, shareholders, directors and officers, beneficial owners, witnesses, experts, consultants, and other natural persons involved in legal matters handled by the Company.
To draft, review, negotiate, enter into, perform, amend, administer, and terminate contracts, legal documents, acts, instruments, and other documentation relating to the legal services provided by the Company.
To conduct analysis, verification, investigation, and legal, commercial, corporate, contractual, regulatory, or other due diligence required in connection with the provision of professional services.
To perform checks and controls intended to identify, prevent, and manage potential conflicts of interest, incompatibilities, and other circumstances that could affect the proper provision of legal services.
To manage commercial proposals, quotations, contracts, professional fees, invoices, billing, payments, accounts receivable, and other financial obligations arising from the relationship with clients and other Data Subjects.
To manage administrative, operational, accounting, financial, tax, and billing activities related to the Company’s operations and its relationships with Data Subjects.
To comply with the Company’s legal, contractual, and regulatory obligations, including tax, accounting, employment, commercial, corporate, administrative, and professional obligations.
To respond to information requests issued by administrative or judicial authorities, supervisory and regulatory bodies, public entities, or authorized third parties, where required by law or by order of a competent authority.
To exercise, manage, and defend the rights and interests of the Company, its clients, and other authorized persons in judicial, administrative, arbitral, conciliation, extrajudicial, or other proceedings.
To conduct activities aimed at preventing, detecting, managing, and mitigating risks associated with fraud, corruption, money laundering, terrorist financing, and other unlawful conduct, where applicable.
To manage the security of the Company’s information and systems, including the prevention, identification, investigation, and handling of security incidents, unauthorized access, loss, alteration, destruction, disclosure, or misuse of information.
To manage and administer the Company’s Databases, including the collection, organization, updating, storage, consultation, validation, cleansing, custody, and preservation of Personal Data.
To contact Data Subjects regarding matters arising from the existing relationship, including confirmations, reminders, follow-up on requests, information updates, meeting coordination, and other communications necessary for proper management.
To share, Transmit, or Transfer Personal Data to Data Processors, suppliers, contractors, business partners, advisors, correspondent firms, and other third parties involved in the Company’s operations, when necessary for the authorized purposes, provision of legal services, or compliance with legal and contractual obligations.
To enable the provision of services by suppliers and specialized third parties in areas including technology services, storage, information hosting, communications, billing, payments, support, auditing, advisory services, and other activities necessary for the Company’s operations.
To verify, validate, consult, and update information provided by Data Subjects, either directly or through legitimate sources, where necessary for the management of relationships or compliance with legal obligations.
To manage recruitment, engagement, hiring, administration, training, evaluation, well-being, professional development, and termination processes relating to employees, professionals, contractors, and service providers.
To manage information required to comply with obligations relating to payroll, social security, employee benefits, occupational health and safety, and other obligations arising from employment or contractual relationships.
To manage the Occupational Health and Safety Management System (Sistema de Gestión de Seguridad y Salud en el Trabajo – SG-SST), including the identification, prevention, assessment, and management of occupational risks; implementation of health promotion and prevention activities; monitoring of employees’ and contractors’ health and safety conditions; management of workplace accidents and incidents; training activities; and other actions necessary to comply with occupational health and safety obligations.
To manage candidate recruitment and evaluation processes, including the receipt, review, and verification of résumés, employment and professional references, and other information relevant to such processes.
To manage information relating to suppliers, contractors, business partners, and other third parties associated with the Company, including onboarding, contracting, evaluation, monitoring, payments, and compliance with applicable obligations.
To manage the physical security of persons, facilities, documents, equipment, and other assets of the Company, including access control, visitor registration, and video surveillance systems.
To capture, record, store, access, and use photographs, images, videos, and voice recordings where necessary for security purposes, documentation of activities or events, provision of services, or other purposes specifically disclosed to the Data Subject.
To manage the entry, presence, and departure of employees, contractors, clients, visitors, suppliers, service providers, and other persons accessing the Company’s premises.
To manage Data Subjects’ interactions with the Company’s websites, platforms, forms, applications, technological tools, and other digital channels.
To manage requests for contact, information, meetings, commercial proposals, or services received through physical or electronic channels.
To provide information regarding the legal services offered by the Company, their characteristics, terms, developments, and other related information.
To send communications relating to retained legal services, pending matters, meetings, documents, events, training activities, publications, newsletters, and other information of interest to Data Subjects.
To conduct marketing, advertising, promotional, and professional relationship activities relating to the Company’s services, events, publications, training activities, and other activities, where the Data Subject has granted the corresponding Authorization when required.
To conduct surveys, measurements, and service quality and satisfaction assessments in order to identify opportunities for improvement.
To carry out business continuity, backup, recovery, maintenance, and protection activities relating to information and systems used by the Company.
To retain, safeguard, and administer Personal Data, documents, files, and other information for the period necessary to fulfill the purposes of Processing, comply with legal, contractual, and professional obligations, exercise or defend rights, and satisfy applicable retention periods.
To carry out any other activities necessary and relevant to the purposes previously disclosed to the Data Subject, provided that such activities are supported by a lawful basis for Processing Personal Data.
To manage, analyze, organize, process, consult, classify, systematize, and generate information through technological tools and artificial intelligence, machine learning, or other similar technologies where necessary for the provision of legal services, management of matters and files, preparation and review of documents, analysis of information, process automation, legal research, administrative management, process optimization, and other activities inherent to the Company, applying the corresponding information security, confidentiality, and data protection measures and in accordance with the authorized purposes and applicable law.
To comply with obligations regarding the prevention of money laundering and terrorist financing, as well as general client due diligence and know-your-client requirements.

CONTENT OF DATABASES

The Databases of ALZATE BLAIR ABOGADOS S.A.S. may contain Personal Data relating to Data Subjects according to the nature of the applicable relationship, the purposes of Processing, and the activities carried out by the Company.

The information actually collected may vary depending on the nature of the relationship with the Data Subject, the legal service retained or requested, the matter or file being handled, the employment or contractual relationship, recruitment processes, relationships with suppliers or third parties, and other activities carried out by the Company.

Databases relating to employees, contractors, or other collaborators may additionally include information concerning employment and academic history and Sensitive Personal Data required due to the nature of the employment, commercial, or service relationship, including photographs, video recordings, family information, biometric data, financial information, and similar information.

CATEGORIES OF PERSONAL DATA

Depending on the nature of the relationship maintained with each Data Subject, the purposes disclosed, and the Authorization granted when required, the Company may collect and Process the following categories of Personal Data:

Identification Data: Full name, type and number of identification document, nationality, date and place of birth, signature, information contained in identification documents, and any other information necessary to identify the Data Subject.
Contact and Location Data: Residential or business address, physical or postal address, city, department, landline or mobile telephone number, email address, professional contact information, and other information necessary to communicate with the Data Subject.
Professional and Employment Data: Profession, occupation, position, employer or entity for which the Data Subject works, professional experience, academic background, employment history, employment information, and professional contact details.
Data Relating to Clients and Prospective Clients: Information necessary to manage the professional relationship, requests, inquiries, proposals, agreements, legal services, entrusted matters, communications, billing, and other activities associated with the provision of legal services.
Data Relating to Legal Matters and File Management: Personal information relating to clients, prospective clients, parties, counterparties, legal representatives, attorneys-in-fact, shareholders, directors and officers, beneficial owners, witnesses, experts, consultants, and other persons whose Personal Data is required for the provision of legal services or the management of proceedings, filings, inquiries, investigations, negotiations, contracts, due diligence processes, and other matters entrusted to the Company.
Contractual Data: Information relating to contracts, obligations, documents, services, professional fees, commercial terms, and other information arising from contractual or professional relationships with the Company.
Financial, Commercial, and Tax Data: Banking information, deposit accounts or payment methods, billing information, professional fees, financial obligations, payments, accounts receivable, commercial references, tax information, and other information required to manage contractual, commercial, accounting, employment, and tax relationships.
Data Relating to Employees, Contractors, and Collaborators: Personal, academic, employment, professional, and contractual information, as well as information required for recruitment, engagement, personnel administration, payroll, social security, occupational health and safety, training, well-being, emergency contacts, beneficiaries, and other activities arising from employment or service relationships.
Candidate Data: Information contained in résumés, identification and contact data, academic background, professional and employment experience, employment and professional references, and other information necessary for recruitment processes.
Data Relating to Suppliers, Contractors, and Business Partners: Identification and contact information, professional or commercial activities, contractual, financial, tax, and banking information, and any information required for onboarding, contracting, monitoring, evaluation, and payment processes.
Access and Security Data: Information required to control access to and presence within the Company’s premises, including visitor logs, vehicle license plate numbers, identification of authorized personnel, and other information required to manage the physical security of persons, assets, and facilities.
Audiovisual Data: Photographs, images, videos, and voice recordings collected in connection with the Company’s activities, video surveillance systems, events, corporate activities, security processes, or other Processing activities previously disclosed to the Data Subject.
Data Generated Through Technological Means: IP addresses, device identifiers, browser information, operating system information, access logs, and other technical data that may be collected when the Data Subject interacts with the Company’s websites, platforms, or technological tools, as applicable.
Communication and Preference Data: Information provided by Data Subjects in requests for information, commercial activities, training sessions, events, surveys, or communications with the Company, including preferences regarding services, content, and communications.
Sensitive Personal Data: In exceptional circumstances, the Company may collect and Process Sensitive Personal Data only where such data is necessary and relevant for a specific, legitimate, and previously disclosed purpose and in accordance with the conditions and safeguards established under applicable law. This category may include, where necessary and appropriate, health information, biometric data, and other information classified as Sensitive Personal Data under Colombian law.

Sensitive Personal Data shall only be Processed where there is a lawful basis permitting such Processing. Where Authorization is required, it shall be obtained in advance, expressly, and on an informed basis, identifying the specific purpose of the Processing and informing the Data Subject that responses to questions concerning Sensitive Personal Data are voluntary.

The Company shall seek to collect only Personal Data that is relevant, appropriate, and necessary for the purposes disclosed to Data Subjects. The information actually collected may vary depending on the nature of the relationship with the Data Subject and the services, proceedings, legal matters, or activities in which the Data Subject participates.

RIGHTS OF DATA SUBJECTS

In accordance with applicable law, Data Subjects have the following rights:

Updating: To update Personal Data contained in the Databases of ALZATE BLAIR ABOGADOS S.A.S. in order to maintain its integrity and accuracy.
Knowledge and Access: To obtain information regarding and access their Personal Data stored by ALZATE BLAIR ABOGADOS S.A.S. or its Data Processors. Such access shall be provided free of charge upon request, subject to applicable legal requirements.
Proof: To request evidence of the Authorization granted to ALZATE BLAIR ABOGADOS S.A.S., except where applicable law provides that such Authorization is not required or has otherwise been validated.
Complaint: To file complaints before the competent authorities for violations of applicable law once the corresponding procedural prerequisites have been satisfied, including first submitting the matter to ALZATE BLAIR ABOGADOS S.A.S. where required.
Rectification: To rectify information and Personal Data under the control of ALZATE BLAIR ABOGADOS S.A.S.
Revocation: To request revocation of the Authorization, provided that there is no legal duty or contractual obligation binding the Data Subject to ALZATE BLAIR ABOGADOS S.A.S. that prevents the Data Subject from requesting deletion of the relevant Personal Data.
Request: To submit requests to ALZATE BLAIR ABOGADOS S.A.S. or the relevant Data Processor concerning the use made of their Personal Data.
Deletion: To request deletion of their Personal Data from the Databases of ALZATE BLAIR ABOGADOS S.A.S., provided that there is no legal duty or contractual obligation requiring the Company to retain such Personal Data.

REVOCATION OF AUTHORIZATION AND/OR DELETION OF PERSONAL DATA

Data Subjects may at any time request that the Company delete the Personal Data referred to in Law 1581 of 2012 and/or revoke the Authorization granted for its Processing by filing a claim in accordance with the procedure established in this Policy.

If, upon expiration of the applicable statutory period, the responsible company has not deleted the Personal Data, the Data Subject shall have the right to request that the Superintendence of Industry and Commerce (Superintendencia de Industria y Comercio) order the revocation of the Authorization and/or deletion of the Personal Data.

Notwithstanding the foregoing, Personal Data must be retained where necessary to comply with a legal or contractual obligation.

Where Data Controllers Process Sensitive Personal Data, prior and express Authorization shall be obtained, subject to the following requirements:

The Data Subject shall be informed that, because the information constitutes Sensitive Personal Data, the Data Subject is not required to authorize its Processing.
The Data Subject shall be informed in advance and expressly of the Sensitive Personal Data to be Processed and the specific purpose for which it will be Processed.

PROCEDURE FOR EXERCISING HABEAS DATA RIGHTS

Data Subjects may exercise their statutory rights and follow the procedures established in this Policy by contacting the Company at [email protected]. The Company shall respond to complaints, requests, and claims in accordance with applicable Personal Data protection regulations.

To exercise the rights to access, update, rectify, or delete Personal Data stored in the Company’s Databases, or to revoke Authorization for the use and storage of such Personal Data, the Data Subject must submit the corresponding written request or claim through the contact channels established for Personal Data Processing.

Data Subjects or their successors-in-interest may exercise the foregoing rights subject to the following rules:

Rights of consultation, rectification, updating, deletion, or revocation of consent may only be exercised by the Data Subject or their successors-in-interest, upon verification of identity, or by an authorized representative upon evidence of the relevant authority.
Where a request is submitted by a person other than the Data Subject and that person does not establish that they are acting on behalf of the Data Subject, the request shall be deemed not to have been submitted.

A request for consultation, rectification, updating, deletion, or revocation must be submitted in writing through the channels enabled by the Company and contain, at a minimum:

- The Data Subject’s name and address or any other means through which a response may be received.
- Documents establishing the applicant’s identity and, where applicable, the identity and authority of their representative.
- A clear and precise description of the Personal Data in relation to which the Data Subject seeks to exercise any of the foregoing rights, together with the specific request.
Any petition, complaint, or claim shall identify the Data Subject, describe the facts giving rise to the claim, provide the relevant address, and include any supporting documents the Data Subject wishes to rely upon. It may be submitted:
- In writing to the Company’s notification address: Carrera 43B No. 16-95, Office 911, Medellín, Antioquia.
- By email to: [email protected]
If a claim is incomplete, the interested party shall be requested, within five (5) days following receipt of the claim, to correct the deficiencies. If two (2) months elapse from the date of the request for additional information without the applicant providing the required information, the claim shall be deemed withdrawn.

If the person receiving the claim is not competent to resolve it, the claim shall be forwarded to the appropriate person within a maximum period of two (2) business days and the interested party shall be informed accordingly.

Once a complete claim has been received, the Database shall include a notation stating “claim pending” together with the reason for the claim within no more than two (2) business days. The notation shall remain in place until the claim has been resolved.

The maximum period for responding to a claim shall be fifteen (15) business days from the day following its receipt. Where it is not possible to respond within such period, the interested party shall be informed of the reasons for the delay and the date by which the claim will be addressed, which may under no circumstances exceed eight (8) business days following expiration of the initial period.

INFORMATION SECURITY

The Company adopts technical, administrative, physical, and organizational measures designed to protect Personal Data and other information under its responsibility against risks including loss, destruction, alteration, unauthorized access, use, or Processing.

Such measures are implemented according to the nature of the information, the purposes of Processing, identified risks, and the Company’s capabilities, and include, among other measures, access controls and permission management, authentication mechanisms, protection measures for systems and devices, information security incident management procedures, backups and recovery mechanisms, as well as physical security measures and controls governing personnel authorized to access information.

Access to Personal Data shall be limited, according to the needs of each process, to persons who are authorized and require such information to perform their duties.

The Company shall also seek to ensure that suppliers, Data Processors, and third parties having access to Personal Data implement appropriate security measures and comply with applicable confidentiality and information protection obligations.

The Company shall review and update its security measures in light of changes to its processes, systems, identified risks, and applicable legal requirements, with the aim of continuously strengthening the protection of Personal Data.

INTERNATIONAL TRANSFER OR TRANSMISSION OF PERSONAL DATA

ALZATE BLAIR ABOGADOS S.A.S. may Transfer and Transmit Personal Data contained in its Databases, including internationally, provided that the applicable legal requirements are satisfied and the Data Subjects expressly authorize such Transfer and Transmission, including at the international level.

For Transfers of Data Subjects’ Personal Data, the necessary measures shall be adopted to ensure that third parties are informed of and undertake to comply with this Policy, on the understanding that the Personal Data received may only be used for matters directly related to the Company or for purposes expressly authorized by the Data Subject, and only while such Authorization remains in effect.

Personal Data may not be used or applied for any different purpose.

AMENDMENTS TO THE PERSONAL DATA PROTECTION POLICY

ALZATE BLAIR ABOGADOS S.A.S. reserves the right to amend or update this Personal Data Protection Policy at any time in response to legislative developments, internal policies, or new requirements relating to the provision or offering of its services or products.