FORJAS BOLIVAR S.A.S., a commercial company legally constituted and identified with NIT 890.906.407-2 and with main domicile in the municipality of Medellín (hereinafter “FORJAS BOLIVAR” or the “Company”), committed to the security of the personal information of its users, customers, suppliers, contractors, employees and the general public, in order to strictly comply with current regulations on the protection of Personal Data contained in Law 1581 of 2012 and Decree 1377 of 2013 and other provisions that modify them , add or complement, it is allowed to present the Personal Data Treatment Policy (hereinafter the “Policy”).

The Policy will apply to all Treatment carried out by the Company, its employees, representatives, agents and contractors and, where appropriate, by those third parties with whom it is agreed, in whole or in part, the performance of any activity related to, or related to with the Treatment of Personal Data in the territory of the Republic of Colombia; on the occasion of the relationship they have with the Company, whether said Treatment is carried out by the Company or by third parties who do it on request. In addition, it only performs Personal Data Processing, when it has been previously authorized by its Owner, implementing for this purpose, clear measures on confidentiality and privacy that prevent adulteration, loss, consultation, use or unauthorized or fraudulent access to Personal Data. .

To carry out any Processing of Personal Data, the Company will request, at the latest at the time of the collection of Personal Data, an authorization from the Holders to carry out said Processing, which, in the case of minors under 18 years of age, will be done through the consent of parents, guardians or legal representatives, informed about the specific purposes for which said consent is obtained. The Personal Data collected, therefore, may only be used by the Company, its employees, representatives, agents and contractors and, as appropriate, by those third parties with whom it is agreed to carry out any activity related to or related to the Treatment of Personal Data for the purposes described in this Policy.

In the case of sensitive Personal Data, the Holder will be informed that said data corresponds to the category of “Sensitive Data”, with which he is not obliged to authorize its Treatment. The Company will submit Sensitive Data to Treatment only when the Holder has granted his authorization, except in cases in which the law does not require said authorization. When The Company will not condition, in any case, any activity to the delivery of Sensitive Data. The Company will submit Sensitive Data to Processing only when the Owner has granted its authorization, except in cases where the law does not require said authorization. The Company will not condition, in any case, any activity to the delivery of Sensitive Data.

The authorization of the Holders may be manifested by: (i) in writing, (ii) orally or (iii) through unequivocal behaviors that allow a reasonable conclusion that the authorization was granted. FORJAS BOLIVAR will keep proof of said authorizations in an appropriate manner.

The following are the Personal Data of the Holders that are collected by FORJAS BOLIVAR in the development of its corporate purpose: (i) names and surnames; (ii) sex of the Data Owner; (iii) date of birth; (iv) address; (v) city; (vi) telephone and (vii) email. However, the Company may request the Personal Data it deems necessary for its operation, which will be duly informed by the Company no later than the time of collection. All Personal Data collected may be stored and hosted in Colombia and/or abroad.

The Personal Data that FORJAS BOLIVAR collects is included in a database to which only the Company’s personnel authorized to do so in the exercise of their functions have access, noting that in no case is authorized for the Treatment of Personal Data for purposes other than those described here: a) Carry out advertising and marketing campaigns to offer discounts or promotions of own or third-party products or services; b) Inform about changes of products or services; c) Implement loyalty programs; d) Evaluate the quality of products and services; e) Prepare market studies that allow establishing consumption preferences or determining payment habits; f) Advance commercial agreements, events or institutional programs directly or in association with third parties; g) Provide products and services directly or through third parties, and receive feedback; h) Inform about new products or services; i) Statistical study activities; j) Send information about activities developed by the Company or send information that is considered of interest through different means; k) Comply with the legal obligations of information to the administrative entities, as well as to the competent authorities that require it; m) Execute the obligations derived from the commercial and labor contracts in which FORJAS BOLIVAR is a party; n) Support the audit processes of the Company; l) Conduct satisfaction surveys; o) Confirm the data necessary for the delivery of products and/or provision of services; p) Carry out the procedures for dealing with PQR’s submitted to the Company; q) Any other purpose that may result in the development of the contract or the commercial relationship between FORJAS BOLIVAR and the Holder, taking into account that said purposes will be previously informed and, at least, at the time of collection.

The Personal Data provided by the Holder, will only be used for the purposes indicated here and once the purpose of the Treatment for which they were collected ceases, they will be eliminated from the FORJAS BOLIVAR databases.

In accordance with art. 8 of Law 1581 of 2012, the Owner of the Personal Data will have the following rights: a) Know, update and rectify their Personal Data in front of the Treatment Managers or Treatment Managers. This right may be exercised, among others, against partial, inaccurate, incomplete, fragmented, misleading data, or those whose Treatment is expressly prohibited or has not been authorized; b) Request proof of the authorization granted to the Data Controller except when the law indicates that the authorization is not necessary, in accordance with the provisions of article 10 of Law 1581 of 2012; c) Be informed by the Treatment Manager or the Treatment Manager, upon request, regarding the use that has been given to their Personal Data; d) Submit to the Superintendency of Industry and Commerce complaints for violations of the provisions of Law 1581 of 2012 and other regulations that modify, add or complement it; e) Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the Treatment. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the Treatment the Person in Charge or in Charge of the Treatment has incurred in conduct contrary to this law and the Constitution; f) Free access to your Personal Data that has been subject to Processing.

The exercise of the Rights may be carried out by (i) the Holder, who must prove his identity sufficiently by the different means made available by the Data Controller, (ii) his successors in title, who must prove such quality, (iii) the representative and/or proxy of the Holder, prior accreditation of the representation or power of attorney and, (iv) by stipulation in favor of another or for another.

In order to protect and maintain the confidentiality of the Personal Data of the Holders, the Company determines that the procedure to know, update, rectify, delete information or revoke the authorization for the Treatment of Personal Data, implies the duty of the Holder to contact FORJAS BOLIVAR through the means provided for it, namely: (i) Making the request by telephone through the service lines provided for it in accordance with the provisions of this Policy; (ii) Sending a written request scanned to the email provided by the Company, which must be accompanied by a copy of the Holder’s identity document or (iii) Sending a written request to the registered office of the Company, which must be accompanied of a copy of the Holder’s identity document.

The Holders of the Personal Data may, at any time, request the Company to delete their data and/or revoke the authorization. The right of deletion is not absolute and the Company may deny its exercise in the following events: (i) When the Holder has a legal or contractual duty to remain in the database or the Data Controller has a legal or contractual obligation that requires you to keep the Personal Data; (ii) The elimination of Personal Data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions; (iii) The Personal Data is necessary to protect the legally protected interests of the Holder, to carry out an action based on the public interest, or to comply with an obligation legally acquired by the Holder or the Treatment Manager.

The Owner of the Personal Data, their successors in title, their representatives and/or attorneys-in-fact may make INQUIRIES about the Personal Data stored in the Company’s databases, in accordance with the following rules: a) The request will be analyzed to verify the Identification of the Holder. If the request is made by a person other than the Holder and it is not proven that the person acts on behalf of the Holder in accordance with current laws, the request will be rejected. b) All inquiries will be answered within a maximum term of ten (10) business days from the date of receipt thereof. When it is not possible to attend the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which their query will be attended, which in no case may exceed five (5) business days following the expiration of the first term.

The Holder, or his successors in title, who consider that the information contained in the FORJAS BOLIVAR Databases should be corrected, updated or deleted, or when they notice the alleged breach of any of the Company’s duties, may file a CLAIM in accordance with the following rules: (a) The request will be analyzed to verify the identification of the Holder. If the request is made by a person other than the Holder and it is not proven that the person acts on behalf of the Holder in accordance with current laws, the request will be rejected; (b) The claim must contain the following information: (i) The identification of the Holder. (ii) Contact information (physical and/or electronic address and contact telephone numbers); (iii) The documents that prove the identity of the Holder, or the representation; (iv) The clear and precise description of the Personal Data with respect to which the Holder seeks to exercise any of the rights; (v) The description of the facts that give rise to the claim; (vi) The documents that you want to assert; (vii) Signature and identification number; (c) If the claim is incomplete, the Company will require the interested party within five (5) days after receipt of the claim to correct the faults. After two (2) months from the date of the request, without the applicant submitting the required information, it will be understood that he has withdrawn the claim; (d) If the area that receives the claim is not competent to resolve it, it will transfer it to the appropriate person within a maximum term of two (2) business days and will inform the interested party of the situation; (e) Once the complete claim is received, a legend will be included in the database that says “claim in process” and the reason for it, in a term not exceeding two (2) business days. Said legend must be maintained until the claim is decided; (f) The maximum term to address the claim will be fifteen (15) business days counted from the day following the date of receipt. When it is not possible to address the claim within said term, the interested party will be informed of the reasons for the delay and the date on which his claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first finished; (g) The Holder has the right, at any time, to request the deletion of his Personal Data. The suppression implies the total or partial elimination of the Personal Data from the Databases, in accordance with the request of the Owner. The right of deletion is not absolute and the Company may deny its exercise in the following events: (i) The Holder has a legal or contractual duty to remain in the database or the Responsible has a legal or contractual obligation that requires him to maintain Personal Data; (ii) The elimination of Personal Data hinders judicial or administrative actions related to tax obligations, the investigation and prosecution of crimes or the updating of administrative sanctions; (iii) The Personal Data is necessary to protect the legally protected interests of the Holder, to carry out an action based on the public interest, or to comply with an obligation legally acquired by the Holder or the Responsible. The IT Area of FORJAS BOLIVAR is in charge of receiving requests, complaints or claims from the Holders of Personal Data at the following notification addresses: Calle 73 N. 51C – 31, telephone 2635500, [email protected].

The Company may modify this Policy when it deems it necessary without notifying the Owner of Personal Data, provided that the modifications are not substantial. A substantial modification for the purposes of this Policy will be understood as a change in relation to the purposes of the Processing and/or the contact details of the Data Controller.

This FORJAS BOLIVAR Policy is effective as of June Eighteen (18), 2017.

FORJAS BOLIVAR S.A.S.