INFORMATION PROCESSING POLICY

INFORMATION PROCESSING POLICY

The Ecoeffy SAS, a non-profit entity, identified with tax identification number NIT 901.286.016 – 3 domiciled in the city of Bogotá D.C., located at the physical address Calle 148 No. 12 C – 69 of the same city and at the electronic address [email protected]ético.org and telephone (+57) 302 4634835 informs the Holders of Personal Data that are treated in any way by Ecoeffy this information processing policy (the “Policy”),complying with Law 1581 of 2012 and Decree 1377 of 2013.

The main purpose of this Policy is to inform the Personal Data Subjects of the rights that assist them, the procedures and mechanisms provided by Ecoeffy to enforce those rights of the Holders, and to make them aware of the scope and purpose of the Processing to which the Personal Data will be subject in case the Owner grants its express, prior and informed authorization.

1. Definitions

Expressions used in capital letters in this Policy shall have the meaning given herein or the meaning given to them by applicable law or jurisprudence, as such law or jurisprudence is amended from time to time.

• “Authorization”: It is the prior, express and informed consent of the Owner to carry out the Processing of your Personal Data.

• “Database”: It is the organized set of Personal Data that are the subject of Processing, electronic or not, whatever the modality of its formation, storage, organization and access.

• “Financial Data”: It is any Personal Data concerning the birth, execution and extinguishment of monetary obligations, regardless of the nature of the contract that gives them origin, the Treatment of which is governed by Law 1266 of 2008 or the rules that complement, modify or add it.

• “Personal Data”: It is any information of any kind, linked to or that may be associated with one or more specific or determinable natural or legal persons.

• “Public Data”: It is the Personal Data classified as such according to the mandates of the law or the Political Constitution and that is not semi-private, private or sensitive. They are public, among others, data relating to the marital status of persons, their profession or profession, their status as a trader or public servant and those that can be obtained without reservation. By their nature, public data may be contained, among others, in public records, public documents, gazettes and official gazettes, duly executed court judgments that are not subject to reservation.

• “Sensitive Data”: It is the Personal Data that affects the privacy of the Holder or whose misuse may lead to its discrimination, such as those that reveal trade union affiliations, racial or ethnic origin, political orientation, religious, moral or philosophical convictions , membership of trade unions, social, human rights organizations or that promotes the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sex life, and biometric data.

• “Treatment Officer”: It is the natural or legal person, public or private, who by itself or in partnership with others, performs the Processing of Personal Data on behalf of the Data Controller.

• “Authorized”: It is Ecoeffy and all persons under the responsibility of Efinetic, who by virtue of the Authorization and these Policies have legitimacy to process the Personal Data of the Owner. The Authorized includes the enabled genre.

• “Enablement”: It is the legitimacy that expressly and in writing by contract or document that makes its own, granted by Ecoeffy to third parties, in compliance with the applicable law, for the processing of Personal Data, making such third parties Data Processors Personal Data delivered or made available.

• “Data Controller”: It is the natural or legal person, public or private, who by itself or in partnership with others, decides on the Database and / or the Processing of Personal Data.

• “Title” of the Personal Data: It is the natural or legal person to whom the information that rests in a database is referred to, and who is the subject of the right to habeas data.

• “Transfer”: It is the Processing of Personal Data that involves the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a Processing by the Processor on behalf of the Responsible.

• “Transmission”: It is the activity of Processing of Personal Data through which the same, internally or with third parties, inside or outside the territory of the Republic of Colombia, is when such communication is intended to carry out any activity Treatment by the Recipient of Personal Data.

• “Processing of Personal Data”: It is any systematic operation and procedure, electronic or not, that allows the collection, preservation, ordering, storage, modification, relationship, use, circulation, evaluation, blocking, destruction and in general, the processing of Data Personal, as well as its transfer to third parties through communications, queries, interconnections, assignments, data messages.

2. Principles

Efintic, in the development of its business activities will collect, use, store, transmit and carry out various operations on the personal data of the Holders. In any Processing of Personal Data performed by Efinticic, the Responsible, Processors and/or third parties to whom Personal Data is transferred, shall comply with the principles and rules established in the law and this Policy, in order to ensure the right to habeas dates back to the Holders and comply with the obligations of Law of Efinetic. These principles are:

• Prior Authorization: Any Processing of Personal Data will be carried out once the Prior, Express and Informed Authorization of the Owner has been obtained, unless the law establishes an exception to this rule. In the event that the Personal Data has been obtained prior to the law, Ecoeffy will seek the relevant ordinary and alternative means to convene the Holders and obtain their retroactive authorization, following the provisions of Decree 1377 and the concordant standards.

• Authorized Purpose: Any activity of Processing of Personal Data must obey the purposes mentioned in this Policy or in the Authorization granted by the Holder of Personal Data, or in the specific documents where each type or process of Data Processing is regulated Personal. The purpose of the particular Processing of a Personal Data must be informed to the Holder of the Personal Data when obtaining his Authorization. Personal Data may not be processed outside of the purposes reported and consented to by the Data Subjects.

• Data Quality: The Personal Data submitted to Treatment must be truthful, complete, accurate, up-to-date, verifiable and understandable. When in the possession of Partial, Incomplete, Fractured or Error-Inducing Personal Data, Ecoeffy shall refrain from Treating it, or request its owner to complete or correct the information.

• Delivery of information to the Holder: Upon request by the Owner, Ecoeffy shall provide you with information about the existence of Personal Data concerning the applicant. This information is provided by Ecoeffy’s personal data protection unit (see point 7 of this Policy).

• Restricted circulation: Personal Data may only be processed by those Ecoeffy personnel who are authorized to do so, or who within their duties are responsible for carrying out such activities. Personal Data may not be provided to those who do not have Authorization or have not been enabled by Ecoeffy to carry out the Processing.

• Temporary: Ecoeffy will not use the owner’s information beyond the reasonable period of time required by the purpose that was informed to the Owner of the Personal Data.

• Restricted access: Except for the Expressly Authorized Data, Ecoeffy may not make Personal Data available for access via the Internet or other massive means of communication, unless technical and security measures are established to control access and restrict ingestate only to Authorized Persons.

• Confidentiality: Ecoeffy must always carry out the Treatment by providing the technical, human and administrative measures that are necessary to maintain the confidentiality of the data and to prevent it from being adulterated, modified, consulted, used, accessed, deleted, or authorized persons or authorized and unauthorized persons fraudulently, or that Personal Data is lost. Any new project involving the processing of Personal Data should be consulted this Processing Policy to ensure compliance with this rule.

• Confidentiality and Subsequent Processing: Any Personal Data other than Public Data must be treated by the Responsible as confidential, even if the contractual relationship or the link between the Personal Data Holder and Ecoeffy is terminated. Upon termination of such link, such Personal Data must continue to be processed in accordance with this Policy and the Law.

• Individuality: Ecoeffy will separately maintain the databases in which it has the quality of The Database Manager in which it is Responsible.

• Need: Personal Data may only be processed during time and to the extent justified by the purpose of its Processing.

3. Treatment and Purposes

The Personal Data processed by Ecoeffy must be strictly subject to the purposes set out below. Likewise, the Processors or third parties who have access to the Personal Data by virtue of law or contract, will keep the Processing within the following purposes:

• Manage all the information necessary for the fulfillment of the tax obligations and commercial, corporate and accounting records of Efinetic

• Comply with Ecoeffy’s internal supplier and contractor management processes.

• Comply with service contracts concluded with customers.

• To provide its services in accordance with the particular needs of Efinetic customers, in order to comply with service contracts concluded, including but not limited to verification of the affiliations and rights of individuals to whom the Ecoeffy customers will provide their services, use Personal Data for marketing and/or marketing of new services or products.

• The other purposes determined by the Controllers in the process of obtaining Personal Data for their Processing and that are communicated to the Owners at the time of the collection of the personal data.

• The control and prevention of fraud and money laundering, including but not limited to consultation in restrictive lists, and all necessary information required for SARLAFT.

• The process of archiving, updating systems, protection and custody of information and databases of Efinetic.

• Processes within Ecoeffy for development or operational purposes and/or system administration.

• The transmission of data to third parties with whom contracts have been concluded for this purpose, for commercial, administrative, marketing and/or operational purposes, including but not limited to the issuance of cards, personalized certificates and certifications to third parties, in accordance with the legal provisions in force.

• Maintain and process by computer or other means, any information related to the customer’s business in order to provide the relevant services and products.

• The other purposes determined by the Controllers in processes of obtaining Personal Data for their Processing, in order to comply with legal and regulatory obligations, as well as the policies of Efinetic.

4. Rights of the Holder of Personal Data

According to the law, Personal Data Subjects have the following rights:

• Know, update and rectify your Personal Data against Ecoeffy or the Data Processors. This right may be exercised, among others against partial, inaccurate, incomplete, fractional, misleading data, or those whose Treatment is expressly prohibited or has not been authorized.

• Request proof of the Authorization granted to Efinetic, unless the law indicates that such Authorization is not necessary.

• Submit requests to Ecoeffy or the Data Processor regarding your use of your Personal Data, and for them to provide such information to you.

• File complaints about violations of the law with the Superintendency of Industry and Commerce.

• Revoke your Authorization and/or request the deletion of your Personal Data from Ecoeffy’s databases when the Superintendency of Industry and Commerce has determined by definitive administrative act that in the Treatment of Ecoeffy or the Processor of the Processing has engaged in conduct contrary to the law or when there is no legal or contractual obligation to keep the Personal Data in the database of the Responsible.

• Request free access and access to your Personal Data that have been processed in accordance with Article 21 of Decree 1377 of 2013.

• Know the modifications to the terms of this Policy in a pre- and efficient manner to the implementation of the new modifications or, failing that, the new information processing policy.

• Have easy access to the text of this Policy and its modifications.

• Easily and easily access Personal Data under Ecoeffy’s control to effectively exercise the rights granted by law to Holders.

• Know the unit or person empowered by Ecoeffy against whom you may file complaints, inquiries, complaints and any other requests about your Personal Data.

Holders may exercise their law rights and perform the procedures set out in this Policy, by presenting their citizenship certificate or original identification document. Minors may exercise their rights personally, or through their parents or adults who hold parental authority, who must demonstrate this by means of the relevant documentation. Likewise, they may exercise the rights of the Owner, the causators who prove this quality, the representative and / or proxy of the holder with the corresponding accreditation and those who have made a stipulation in favor of another or for another.

5. Responsible for Personal Data Protection

Ecoeffy has designated [Servicio al Cliente] the management as Responsible for the reception and attention of requests, complaints, complaints and inquiries of all kinds related to Personal Data. The customer service person will process inquiries and complaints regarding Personal Data in accordance with the Law and this policy.

Some of the particular functions of this area in relation to Personal Data are:

• Receive requests from Personal Data Subjects, process and respond to those based on law or these Policies, such as: requests for updating Personal Data; requests to know the Personal Data; requests for the deletion of Personal Data when the Owner submits a copy of the decision of the Superintendency of Industry and Commerce in accordance with the provisions of the law, requests for information about the use given to their Personal Data, requests for updating of Personal Data, requests for proof of the Authorization granted, where it has proceeded according to the law.

• Respond to The Holders of Personal Data on those requests that do not proceed in accordance with the Law.

The contact details are:

Physical address: Calle 148 No. 13 C – 69 in Bogota, D.C.

E-mail address: [email protected]

Phone: (+57) 302 4634835

Contact Person Charge: [Analista de Servicio al Cliente]

6. Special provisions

Without prejudice to the general application of this privacy policy for Efinticic, in consideration of the services provided through the website the data subjects recognize and accept

• That the personal data of representatives or natural persons that are provided to Ecoeffy will have the processing set out in this Policy.

• That, for the provision of the service, Ecoeffy may request financial, accounting, tax, business or other information from the owner of the data.

• That Ecoeffy will not use the information from the above numeral for fraudulent or unfair competition purposes.

• That the specific conditions of the Service or any confidentiality agreement sunders between Ecoeffy and the data subject, will be established in documents between the parties.

• That, in any case, Ecoeffy undertakes not to disclose in any way owner information for competitive purposes or of impact on the market.

On the other hand, Efinetic, at the time of registration, will collect customer information for the following purposes:

• Internal use; And

• To send regular newsletters to customers with news and news from the sector.

7. Procedures for exercising the rights of Personal Data Subjects

Consultations: Ecoeffy will have mechanisms for the Holder, its prosecists, its representatives and/or proxy, those to whom it has been stipulated in favor of another or for another, and/or representatives of minors Holders, to consult with respect to what are the Personal Data of the Owner who rest sits on the Efinetic Databases.

These mechanisms may be physical as a window process, or electronic through the mail [email protected] or by telephone on the hotlines: (+57) 302 4634835, responsible for receiving requests, complaints and complaints on phones.

Whatever the means, Ecoeffy will keep proof of the query and its response.

• If the applicant has the capacity to make the consultation, in accordance with the accreditation criteria established in Law 1581 and Decree 1377, Ecoeffy will collect all the information about the Holder that is contained in the individual register of that person or that is linked to the identification of the Holder within Ecoeffy’s databases and will be made known to the applicant.

• The Person Responsible for attending the consultation will respond to the applicant provided that he/she is entitled to it because he is the Personal Data Subject, his causator, proxy, representative, has been stipulated by another or for another, or is the legal responsible in the case of minors.

• In the event that the application cannot be met within ten (10) working hours, the applicant will be contacted to inform them of the reasons why the status of his application is pending. To do this, the same or similar means will be used as the one used by the Holder to communicate its request.

Claims: Ecoeffy has mechanisms for the Holder, its prosecists, representative and/or proxy, those who stipulated for another or for another, and/or representatives of minors Holders, make claims regarding (i) Personal Data processed by Ecoeffy that must be corrected, updated or deleted, or (ii) the alleged non-compliance with the duties of Law of Efinetic.

These mechanisms may be physical as a window process, electronic through the mail [email protected] or by telephone on the hotline (+57) 302 4634835, responsible for receiving requests, complaints and complaints on phones.

• The claim must be filed by the Holder, its proboriginals or representatives or accredited in accordance with Law 1581 and Decree 1377, as follows:

• You must go to the Ecoeffy SAS electronically to the address [email protected] or physically to the address Calle 148 No. 12 C – 69 in Bogota, D.C.; telephone on the hotline (+57) 302 4634835.
• It must contain the name and identification document of the Holder.
• It shall contain a description of the facts giving rise to the claim and the objective pursued (update, correction or deletion, or fulfillment of duties).
• You must provide the address and contact details and identification of the claimant.
• All documentation that the complainant wishes to assert must be accompanied by all documentation.
• Ecoeffy before dealing with the claim will verify the identity of the Personal Data Subject, its representative and/or proxy, or the accreditation that there was a stipulation by another or for another. To do this, it may require the card of citizenship or original identification document of the Holder, and the special, general or document powers that are required as the case may be.

• If the claim or additional documentation is incomplete, Ecoeffy will require the claimant for one to remedy the failures. If the claimant does not submit the required documentation and information within ten (10) business days of the date of the initial claim, it will be deemed to have withdrawn from the claim.

• If by any fact the person receiving the claim within Ecoeffy is not competent to resolve it, he will transfer customer service analyst, and inform the complainant of such referral.

• Once the claim is received with the complete documentation, it will be included in the Ecoeffy Database where the Holder Data subject to claim is replenished a legend that says “claim in process” and the reason for it. This legend must be maintained until the claim is decided.

8. Effect

This Policy applies from 1 August 2019. Personal Data that is stored, used or transmitted will remain in our Database, based on the criterion of temporality and necessity, for as long as necessary for the purposes mentioned in this Policy, for which they were Collected.