The company ALZATE BLAIR ABOGADOS S.A.S. (hereinafter “ALZATE BLAIR ABOGADOS”), is pleased to present to all its users, clients, investors, employees, and to all third parties, natural persons with whom it has a relationship, the present privacy and personal data treatment policy (hereinafter the “Policy”), which was prepared based on Articles 15 and 20 of the Political Constitution of Colombia, Law 1581 of 2012, Decree 1377 of 2013 and other complementary regulations which describe the mechanisms through which an adequate handling of personal data is guaranteed, with the objective of allowing the holders of the same to exercise the right of Habeas Data.

Its purpose is to inform the treatment that ALZATE BLAIR ABOGADOS gives to the personal data it has in its databases, the rights of the owners of this personal data and the mechanisms available to exercise them, which have been and will always be obtained with the prior consent of the owners, so the treatment given to them, is in accordance with the provisions of Law 1581 of 2012 and Decree 1377 of 2013.

RESPONSIBLE

ALZATE BLAIR ABOGADOS is a private legal entity, domiciled in the city of Medellín and identified with NIT 900.825.714 – 6 whose contact details are:

Address: CARRERA 42 #3 SUR -81. Centro de Negocios Milla de Oro Torre 2 Of 511.

E-mail: [email protected]

Phone number: (604) 408 42 48

DEFINITIONS

For the purposes of this Policy, the following words shall have the meanings mentioned below:

• “Authorization”: Prior, express and informed consent of the holder to carry out the processing of personal data;
• “Aviso de privacidad”: Comunicación verbal o escrita generada por el Responsable del Tratamiento, dirigida al Titular para el Tratamiento de sus Datos Personales, mediante la cual se le informa acerca de la existencia de las políticas de Tratamiento de información que le serán aplicables, la forma de acceder a las mismas y las finalidades del Tratamiento que se pretende dar a los Datos Personales.
• “Database”: Organized set of personal data.
•   “Personal data”: any information linked or that can be associated to one or more natural persons determined or determinable.
• “Public Data: Data that is not semi-private, private or sensitive. Public Data are considered, among others, the data related to the civil status of persons, their profession or trade and their status as merchant or public servant.
• “Sensitive Data”: Sensitive Data are understood as those that affect the holder’s privacy or whose improper use may generate discrimination, as well as data related to health, sex life, and biometric data;
• “Data Processor”: Natural or legal person, public or private, that by itself or in association with others, carries out the processing of Personal Data on behalf of the Data Controller;
• “Data Controller”: Natural or legal person, public or private, that by itself or in association with others, decides on the Database and/or the processing of Personal Data;
• “Data Subject”: Natural person whose Personal Data is the object of processing;
• “Transfer”: The transfer of data takes place when the Controller and/or Processor of Personal Data, located in Colombia, sends the information or Personal Data to a recipient, which in turn is the Data Controller and is located inside or outside the country;
• “Transmission”: Processing of Personal Data that involves the communication of the same within or outside the territory of Colombia when its purpose is the performance of a processing by the Processor on behalf of the Controller.
• “Processing”: Any operation or set of operations on Personal Data, such as collection, storage, use, circulation or deletion.

CONTENT OF THE DATABASES

ALZATE BLAIR ABOGADOS’ databases store general information such as names and surnames, type and number of identification, age, gender, department, city, neighborhood and residence address, landline and cellular phones, e-mail address. In addition to these, and depending on the nature of the database, ALZATE BLAIR ABOGADOS may have specific data required for the treatment to which the data will be submitted. The database of employees or contractors includes, additionally, information on labor and academic history, sensitive data required by the nature of the employment relationship (photograph, family group, biometric data, financial data, etc.).

TREATMENT OF PERSONAL DATA

ALZATE BLAIR ABOGADOS stores, collects, uses, processes, deletes and circulates Personal Data in connection with the provision of its services and/or due to a labor, commercial or civil relationship with the different Personal Data Holders. By virtue of the foregoing, Personal Data are used (manually and automatically) for:

• Execute contracts of any other type subscribed with the Holders, in order to provide an effective service.
• Contact the Holders by virtue of the existing commercial, civil or labor relationship.
• Pay fees, remunerations or salaries arising by virtue of the commercial, civil or labor relations existing with the Holders.
• Comply with the labor obligations, which according to the Colombian regulations arise for the Company as employer.
• Manage all the necessary information for compliance with tax obligations and commercial, corporate and accounting records of the Company.
• Comply with the obligations of prevention of money laundering and terrorist financing.
• Send messages for commercial, advertising and/or customer service purposes to the Holders.
• Register the information of the Holders in the Company’s Database.
• Provide the Services offered in the Web Site.
• Make reports to the different administrative authorities of control and surveillance, police authorities or judicial authorities.
• Internal administrative procedures of the Company such as accounting reports, audits and invoicing.

• Transmission of information to third parties involved in the provision, production or marketing of the products or services offered.

• Promote activities and services offered by ALZATE BLAIR ABOGADOS. For this purpose, different means of communication will be used, such as mail, e-mail, landline and cell phone (including text and voice messages), without being limited exclusively to these.

• Any other purpose resulting from the development of the contract entered into with the Holder.

Taking into account that ALZATE BLAIR ABOGADOS has employees, allies and suppliers for the proper development of its corporate purpose and for the execution of other labor, commercial or civil contracts entered into with the Data Subjects; ALZATE BLAIR ABOGADOS will be the Data Controller and its employees, allies and suppliers will be the Data Processors, to this extent ALZATE BLAIR ABOGADOS ensures that the Data Processors will strictly comply with the provisions of this Policy.

In the event that the development of its corporate purpose and the execution of other labor, commercial or civil contracts entered into with the Data Controllers involves the Transfer or Transmission of Personal Data to foreign allies, partners or suppliers, ALZATE BLAIR ABOGADOS undertakes that they will adhere to the provisions of Law 1581 of 2012 and Decree 1377 of 2013 on Personal Data protection, and specifically give strict compliance with the provisions of this Policy.

Once the commercial, labor or civil relationship with the Data Controllers is concluded, the Personal Data will only be used for the purpose of keeping them in the corresponding database register and sending them messages for commercial and/or advertising purposes, offering business or services, if so authorized by the Data Controller, otherwise, they will be eliminated from ALZATE BLAIR ABOGADOS’ Databases or filed in secure conditions when required by Colombian regulations.

RIGHTS OF THE OWNERS

The Personal Data Subject shall have the following rights:

• To know, update and rectify their Personal Data with respect to the Data Controllers or Data Processors. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or data whose processing is expressly prohibited or has not been authorized;
• Request proof of the Authorization granted to the Data Controller except when expressly exempted as a requirement for the Processing, in accordance with the provisions of Article 10 of Law 1581 of 2012;
• Be informed by the Data Controller or the Data Processor, upon request, regarding the use given to their Personal Data;
• File complaints before the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other rules that modify, add or complement it;
• To revoke the authorization and/or request the deletion of the Personal Data when the Processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or suppression will proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Controller or Processor has incurred in conduct contrary to the law and the Constitution;

   Access free of charge to their Personal Data that have been subject to Processing.

OBLIGATIONS OF ALZATE BLAIR ABOGADOS

• Guarantee the Data Subject, at all times, the full and effective exercise of the right of habeas data.
• Request and keep, under the conditions provided for in this law, a copy of the respective authorization granted by the Data Subject.
• Duly inform the Data Subject about the purpose of the collection and the rights he/she has by virtue of the authorization granted.
• Keep the information under the security conditions necessary to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.     

• To guarantee that the information provided to the person in charge is truthful, complete, accurate, updated, verifiable and understandable.

• Update the information, communicating in a timely manner to the Data Processor, all developments with respect to the data previously provided and take other necessary measures to ensure that the information provided to this is kept up to date.

• Rectify the information when it is incorrect and communicate the relevant information to the Data Processor.

• To provide to the Data Processor, as the case may be, only data whose processing is previously authorized in accordance with the provisions of this policy.

   

• To require the Data Processor, at all times, to respect the security and privacy conditions of the Data Subject’s information.

   

• To process the queries and claims formulated in the terms set forth in this policy.     

• Inform the Data Controller when certain information is under discussion by the Data Subject, once the claim has been filed and the respective process has not been completed.     

• To inform, at the Holder’s request, about the use given to his/her data;     

• Inform the data protection authority when there are violations to the security codes and there are risks in the administration of the information of the Holders.     

• Comply with the instructions and requirements given by the Superintendence of Industry and Commerce.

INFORMATION SECURITY

ALZATE BLAIR ABOGADOS uses strict security procedures to guarantee the integrity, confidentiality and security of the information and personal data provided by the Holder, such as restricting access to the information only to authorized personnel, secure software development practices, which prevent its alteration and unauthorized treatment or access, procedures that are also adopted by all those to whom ALZATE BLAIR ABOGADOS transmits such information.

PROCEDURES FOR ACCESS, CONSULTATION AND COMPLAINTS ABOUT PERSONAL DATA

ALZATE BLAIR ABOGADOS guarantees that the Owners of the Personal Data to which it is given Treatment, will have access to them, and will be informed about all modifications, updates or deletions that are made of them.

ALZATE BLAIR ABOGADOS provides the following email address: [email protected], to which the Holder or those entitled according to Law 1581 of 2012, may write to access their personal information, to prove the treatment that is being given to their Personal Data, to file claims or request its update, rectification or deletion, and to request proof of the authorization given by him/her in due course.

ALZATE BLAIR ABOGADOS will have a period of 15 days to respond to requests, claims or inquiries. If the claim, request or consultation is incomplete, the interested party will be required within five (5) days of receipt thereof to remedy the faults. After two (2) months from the date of the requirement, without the applicant submitting the required information, it will be understood that the claim has been withdrawn.

To address the claim, request or inquiry, it is necessary that the Holder or those entitled according to Law 1581 of 2012, provide the following information:

• Full Name
• Identification number
• Notification or reply address
• Contact telephone number
• When the applicant is not the Holder, he/she must provide the information that in accordance with Law 1581 of 2012 legitimizes him/her to make the request, consultation or claim on behalf of the Holder.

EFFECTIVENESS

This Policy is effective as of October 01, 2016, updated on November 07, 2023. Any modification will be timely informed to the Holders.