Personal Data Protection Policy

VERONORTE S.A.S, committed to the security of the personal information of its users, clients, suppliers, contractors, employees and the general public, establishes this Personal Data Protection Policy regarding the collection, use and transfer of personal data.

i) Legal Framework

The legal framework is based on the Colombian Political Constitution, specifically Articles 15 and 20; Law 1581 of 2012, Decree 1377 of 2013 and other provisions that modify, supplement or complement them.

ii) Definitions

• Personal data: any information relating to an identified or identifiable natural person.
• Data controller: determines the purposes and means by which personal data is processed. Veronorte is the data controller.
• Data subject/Holder: a person who has the right to grant access to or share data.
• Data processing: access, collection, use, processing, storage, sharing, distribution, transfer, disclosure, security, destruction or disposal.
• Consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes.
• Database: an organized collection of structured information, typically stored electronically.
• Sensitive data: information protected against unwarranted disclosure.

iii) Objective

To detail the guidelines for protecting the Personal Data of Data Subjects and procedures for knowing, updating, rectifying and deleting information. Veronorte collects data from third parties who voluntarily authorize such collection for programs or projects in accordance with its corporate purpose. The information will never be used for illicit purposes, commercialization or in a manner that harms the interests of Data Subjects.

iv) Validity

Personal Data provided will remain valid for the duration of programs or projects or as long as the purpose for which it was collected persists.

v) Personal Data Included in the Database

Veronorte collects the following data:

• Type of identification document
• Identification document number
• Full name
• Address
• Phone number(s)
• Email address
• City
• Country

Veronorte employees will have access to the Databases in the exercise of their functions and for collection purposes, or in cases where the law expressly authorizes it.

vi) Privacy and Personal Data Protection Policies

Data provided will be incorporated into a database owned by VERONORTE. Registered users consent to their data being used and processed for research, promotion and marketing of services and products.

VERONORTE is committed to maintaining absolute privacy of data provided by Users, classified as Personal Data under Colombian Law 1581 of 2012 and Decree 1377 of 2013, except:

• When express authorization exists from the User
• In cases of Public Personal Data
• When required by a judicial authority or State Entity
• When expressly stated by law

vii) Rights of Data Subjects

Data Subjects may file complaints, claims, inquiries, delete data, add or modify existing information. They have the right to accept or deny the inclusion of their information in Veronorte's Databases. These rights may be exercised as indicated in this document or through procedures established in the referenced legal framework.

viii) Sensitive Data

Sensitive data is data that affects the privacy of the Data Subject or whose misuse generates discrimination, such as:

• Racial or ethnic origin
• Political orientation
• Religious or philosophical convictions
• Membership in unions, social organizations, or human rights organizations
• Political party interests
• Health-related data
• Sexual life
• Biometric data

Veronorte may use sensitive data when the Data Subject has given explicit authorization personally or through a legal representative, or in events provided for in Article 6 of Law 1581 of 2012.

ix) Processing of Personal Data of Children and Adolescents

Processing will ensure respect for the prevailing rights of minors, being processed only when authorized by law. It is the task of the State and educational entities to provide information about the risks of improper data processing of minors. By Veronorte's policies, information from minors will not be requested or collected to avoid violating fundamental rights.

x) Authorization by the Data Subject

Collection, storage, use and circulation of Personal Data requires free, prior and express consent from the Data Subject, through web forms or means permitted under Law 1581 of 2012. Veronorte reserves the right to delete Personal Data at any time without the Data Subject's authorization.

xi) Department Responsible for Data Processing

The responsible department is Office Management, in charge of internal handling of Personal Data and efficient responses to Data Subject requests.

xii) Complaints or Claims

Data Subjects may file complaints or claims free of charge with the Data Controller at info@veronorte.com if they believe information should be corrected, updated or deleted, or if they notice non-compliance with duties established in Law 1581 of 2012 and Decree 1377 of 2013.

xiii) Inquiry Process

Veronorte will respond to inquiries, complaints or claims within a maximum of fifteen (15) business days from the day following receipt of the complaint, claim or inquiry. If it does not, the applicant will receive an explanation and response within a maximum of eight (8) business days.

xiv) Revocation of Authorization

The Data Subject may revoke consent for the use of personal data in whole or in part at any time, provided it is not prevented by legal or contractual provisions. Revocation is made before the responsible department with priority processing.

xv) Information Security

Veronorte will adopt necessary measures to prevent loss of information, access by unauthorized persons, adulteration of information and other methods that may endanger the Data Subject's information.

xvi) Use and International Transfer of Personal Data

Personal Data will not be transferred to a company in another country that does not comply with the Data Protection guidelines established by the Superintendence of Industry and Commerce, unless prior and express authorization from the Data Subject is obtained or in cases where the law authorizes without affecting the interests of Data Subjects.

xvii) National Database Registry

Veronorte reserves the right to maintain and catalog certain information in Databases as confidential. It will register databases with the National Database Registry (RNBD) in accordance with current regulations and Government regulations. The RNBD is administered by the Superintendence of Industry and Commerce, being a public directory of databases subject to processing operating in the country, freely accessible to citizens.

This document was last updated on January 18, 2022.