Data Processing Policy

DATA PROCESSING POLICY OF LIMPIAFY S.A.S
Version No. 01

Contents

1. LEGAL FRAMEWORK AND SCOPE
2. COMPANY NAME AND IDENTIFICATION – DATA CONTROLLER
3. SCOPE
4. PURPOSE OF PERSONAL DATA PROCESSING
5. DEFINITIONS
6. CONSENT FROM DATA SUBJECTS
7. RESPONSIBILITIES OF THE DATA CONTROLLER
8. RIGHTS OF DATA SUBJECTS
9. HANDLING INQUIRIES, CLAIMS, AND REQUESTS
10. DEPARTMENT OR PERSON IN CHARGE OF HANDLING COMPLAINTS, CLAIMS, AND REQUESTS
11. SECURITY MEASURES
12. MODIFICATIONS TO THE DATA PROCESSING POLICY
13. EFFECTIVE DATE

• APPENDIX: Privacy notice template and consent for using personal data

LEGAL FRAMEWORK AND SCOPE

In compliance with Statutory Law 1581 of 2012, Regulatory Decrees 1377 of 2013, 1074 of 2015, and other complementary regulations, LIMPIAFY S.A.S outlines its policy regarding the processing and protection of personal data.

COMPANY NAME AND IDENTIFICATION – DATA CONTROLLER

LIMPIAFY S.A.S, identified with NIT. 901758163 – 4, headquartered at Cl 50 No. 81B 17 of 209, Medellín, email: experiencia@limpiafy.co, Phone: (034) 540 31 60.

SCOPE

These policies apply to all partners, employees, and suppliers of LIMPIAFY S.A.S, as well as all clients, external advisors, and temporary personnel who use the resources and services provided by LIMPIAFY S.A.S.

PURPOSE OF PERSONAL DATA PROCESSING

Authorization for the processing of personal data allows LIMPIAFY S.A.S to collect, transfer, store, use, share, delete, update, and transmit personal data to meet the company’s legal and business objectives.
At any time, the Data Subject can revoke consent or request data deletion.
By using LIMPIAFY S.A.S’s various available channels, the Data Subject gives prior, express, and informed consent for the inclusion of their information in the databases managed by LIMPIAFY S.A.S, and for its processing.

DEFINITIONS

The following definitions are established in Article 3 of Statutory Law 1581 of 2012 and Article 3 of Decree 1377 of 2013:

• Authorization: Prior, express, and informed consent given by the Data Subject for processing personal data.
• Privacy Notice: A verbal or written communication issued by the data controller to inform the Data Subject about the existence of data processing policies applicable to them, how to access these policies, and the purposes of processing their personal data.
• Database: An organized set of personal data that is subject to processing.
• Personal Data: Any information linked or that can be associated with one or more determined or determinable natural persons.
• Public Data: Data that is not semi-private, private, or sensitive. Public data includes, among others, information related to a person’s marital status, profession, and public or commercial status.
• Sensitive Data: Data that affects the privacy of the Data Subject or whose misuse can lead to discrimination, such as information revealing racial or ethnic origin, political orientation, religious or philosophical beliefs, union membership, health, sexual life, and biometric data.
• Data Processor: A natural or legal person, public or private, that processes personal data on behalf of the data controller.
• Data Controller: A natural or legal person, public or private, that alone or in association with others, decides about the database and the processing of the data.
• Data Subject: A natural or legal person whose personal data is processed.
• Transfer: The action taken when the data controller and/or data processor located in Colombia sends information or personal data to a recipient, who in turn is responsible for processing the data, either within or outside the country.
• Transmission: Processing personal data that involves communication within or outside the territory of the Republic of Colombia to perform a processing task on behalf of the data controller.
• Processing: Any operation or set of operations performed on personal data, such as collection, storage, use, circulation, or deletion.

CONSENT FROM DATA SUBJECTS

LIMPIAFY S.A.S has implemented mechanisms through technical means that facilitate automated consent from the Data Subject. Authorization may be recorded in a physical document, electronically, via data messages, phone, internet, websites, WhatsApp, or any other format that guarantees the possibility of future consultation.

If, within ten (10) business days after submitting any of the above mechanisms, the Data Subject has not communicated with the Data Controller or Processor, they may continue processing the data contained in their databases for the purposes indicated in the data processing policy, without prejudice to the Data Subject’s right to request data deletion.

By accepting this personal data processing policy, the Data Subject agrees that their data may be subject to internal or external audits by companies specializing in such control, all under confidentiality agreements.

RESPONSIBILITIES OF THE DATA CONTROLLER

As the Data Controller, LIMPIAFY S.A.S will adhere to the following responsibilities:

1. Ensure that Data Subjects can fully and effectively exercise their right to habeas data at all times.
2. Request and retain a copy of the respective authorization granted by the Data Subject, as stipulated by this law.
3. Properly inform the Data Subject about the purpose of data collection and their rights under the granted authorization.
4. Keep the information under necessary security conditions to prevent unauthorized or fraudulent alteration, loss, consultation, use, or access.
5. Ensure that the information provided to the Data Processor is truthful, complete, accurate, up-to-date, verifiable, and understandable.
6. Update the information promptly by notifying the Data Processor of any changes regarding the data previously provided, and take other necessary measures to keep the information provided up to date.
7. Correct any inaccuracies in the information and communicate relevant changes to the Data Processor.
8. Provide the Data Processor with only those data whose processing is authorized under the law.
9. Ensure that the Data Processor respects the security and privacy conditions of the Data Subject’s information.
10. Address inquiries and claims as outlined in this manual.
11. Notify the Data Processor when certain information is under dispute by the Data Subject, once a claim has been filed and the respective process has not been concluded.
12. Inform the data protection authority when security code violations occur and when there are risks in the management of Data Subjects’ information.
13. Comply with instructions and requirements issued by the Superintendence of Industry and Commerce.

RIGHTS OF DATA SUBJECTS

Data Subjects have the following rights:

1. To know, update, and correct their personal data.
2. To request proof of the authorization granted to the entity.
3. To be informed by the entity, upon request, about the use of their personal data.
4. To file complaints with the Superintendence of Industry and Commerce for violations of the provisions of Law 1581 of 2012 and other modifying, adding, or complementary regulations.
5. To revoke the authorization and/or request data deletion when the processing does not respect the constitutional and legal principles, rights, and guarantees. Revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the Entity has engaged in conduct contrary to the law and the Constitution.

These rights can be exercised by the following individuals:

• The Data Subject, who must sufficiently prove their identity through various means available by LIMPIAFY S.A.S.
• Their heirs, who must prove their status.
• The Data Subject’s representative and/or attorney, upon proof of representation or power of attorney.
• Public or administrative entities exercising their legal functions or by court order.

HANDLING INQUIRIES, CLAIMS, AND REQUESTS

For LIMPIAFY ENTERPRISE S.A.S, the following procedures apply for inquiries, claims, and requests:

• INQUIRIES: The Data Subject may exercise their right to access or inquire about their data by submitting a written request to LIMPIAFY S.A.S, indicating “Exercise of the Right of Access or Inquiry” in the subject line, or via postal mail sent to Cl 50 No. 81B 17 of 209, Medellín. The request must include:
  • Full name and surname of the Data Subject.
  • A copy of the Data Subject’s Citizenship ID and, if applicable, of the person representing them, as well as a document proving such representation.
  • A specific request for access or inquiry.
  • Address for notifications, date, and signature of the applicant.
  • Supporting documents for the request, if applicable.
• The Data Subject can choose one of the following methods for consulting the database to receive the requested information:
  • On-screen viewing.
  • In writing, with a copy or photocopy sent by certified or non-certified mail.
  • Tele copy.
  • Email or other electronic means.
  • Any other method suitable to the database’s configuration or the nature of the processing, provided by LIMPIAFY S.A.S.
• Upon receiving the request, LIMPIAFY S.A.S will respond to the request within ten (10) business days from the receipt date. The requested information will be provided within a maximum of five (5) business days from the inquiry date.