PERSONAL INFORMATION PROCESSING POLICY

Last Updated: 28-06-2023

JA DEL RÍO, S.A.S. with NIT 901098474 - 7 (hereinafter "JADR" or the "Controller" interchangeably), has the obligation to comply with the administrative, legal and security measures sufficient to protect the personal information that it has collected from "You" (hereinafter "You" or the "Holder") for the purposes that will be described in this Personal Information Processing Policy (hereinafter the "Policy"), in accordance with the provisions of Law 1581 of 2012 and Decree 1074 of 2015 and various current and related regulations (the "Personal Information Legislation").

JADR is committed to ensuring that all legal principles of personal information protection are complied with and we express our commitment so that this Policy is respected at all times, by us and by our collaborators.

All of the above is done in order for “You” to have full control and decision over your personal information, in order to guarantee the right of informational self-determination. Therefore, we recommend that you carefully read the following information:

1. Responsible party

"JADR", with address at Edificio Paralelo 108. Autopista Norte, Av. Carrera 45. No. 108-27, Torre 2, Oficina. 1502. Bogotá, Colombia, with NIT 901098474 – 7, telephone +57 (60) 1 443 14 40, and email privacynotice@jadelrio.com, is "Responsible" for the processing of the personal data you provide us in accordance with the provisions of this Policy.

2. Personal Information

“JADR” will collect from “You” the personal information necessary for the proper provision of services and/or fulfillment of the purposes of the “Controller”, which include the following: (i) first name(s), last name and/or name or corporate name; (ii) address; (iii) landline or cell phone number; (iv) email, (v) social media accounts, (vi) RFC (taxpayer code), (vii) CURP (unique population registration code), (viii) copy of official identification and (ix) document proving the legal representation of the legal entity.

“You” agree that the information you provide to “JADR” is true, complete and accurate. Any false, incomplete or inaccurate information provided will be your sole responsibility.

3. Processing and purpose of gathering your personal information.

The processing that JADR will carry out with the personal information will be as follows: The collection, storage, use, circulation and, if required by the holder or to end the processing, the deletion of personal information.

However, this Policy aims to protect any information concerning identified or identifiable natural persons (the "Personal Information"), such as customers, vendors, workers and other third parties related to the Company (the "Holders"), regulating the use and protection of the Personal Data of the "Holders", through their legitimate, controlled and informed processing, in order to guarantee their privacy.

The personal data you have provided to us will be used for the purposes of “JADR” and for the activities related to the development of such purposes, including but not limited to:

1. Maintain, develop, manage, control and comply with the contractual relationship derived from the request and/or contracting of our services.

2. Confirm your identity and contact information.

3. Create, sort, catalogue, classify and store files and databases of the "Holders", as well as their accounts.

4. Provide the "Holder" with information, communications and notifications about our services.

5. Perform collection activities.

6. Provide advice, clarification and customer service, via telephone, email and/or any other means.

7. Monitor the quality of our customer service through calls and/or emails and/or any other environment, as well as the attention provided through such means.

8. Statistics and log-on history.

9. Attend to legal requirements of relevant authorities, national or foreign, and comply with the obligations derived from the legal relationship between "You" and the "Controller" and/or its parent, affiliated and subsidiary companies.

10. Comply with any legal provisions and obligations applicable to the "Controller", its parent companies, subsidiaries and/or affiliates, as well as to manage any judicial process thereof.

11. Complementary and/or similar activities for the realization of the above purposes.

12. We will process the Personal Information for the following secondary or ancillary purposes: Attraction of talent, marketing, advertising, promotion, newsletters, data profiling, advertising messages, news, event invitations, commercial prospecting and offer of services, general or personalized, sent by any other means.

In the event that you do not want your personal information to be processed for these secondary or accessory purposes, “You” may follow the procedure referred to in section 7 of this Policy.

4. Data transfer

"JADR", as "Responsible" for the processing of the Personal Data of the "Holders", is obliged to comply with the principles established in article 8 of Law 1581 of 2012. For this reason, the "Data Controller" undertakes to maintain strict confidentiality regarding the Personal Data of the "Data Controllers".

Notwithstanding the foregoing, your Personal Data may be transferred within the national territory or abroad when any of the following cases is updated:

1. When the transfer is provided for in a Law or Treaty to which Colombia is part;

2. When the transfer is made to controlling, subsidiary, affiliated or subject companies or under common control with the “Controller”, which operate under the same internal processes and policies of the “Controller”;

3. When the transfer is made to authorities, government bodies or entities, notaries public and public brokers: (i) in compliance with or in relation to the obligations contemplated in the legislation applicable to the "Responsible", its parent companies, subsidiaries and/or affiliates, as well as in compliance with requirements made to them; (ii) to fulfill obligations derived from a legal relationship between the "Holder" and the "Responsible"; (iii) when the transfer is necessary for the maintenance or fulfillment of the relationship between the "Responsible" and the "Holder" and (iv) for the recognition, exercise or defense of a right of the "Responsible", its parent companies, subsidiaries and/or affiliates, in an administrative and/or judicial process;

4. When the transfer is necessary by virtue of a contract concluded or to be concluded in the interest of the provider of the Personal Data, by the controller and a third party;

5. When the transfer is necessary or legally required to protect the public interest, or to the enforcement or administration of justice;

In any case, to transfer personal data to third parties located inside or outside Colombia, including, but not limited to, affiliated entities and companies, subsidiaries and parents, in which case said third parties will have the quality of responsible for the processing of personal data, they may make use of the personal information for any of the purposes indicated in the respective authorization.

5. Withdrawal of consent

At any time "You" may revoke the consent you have given us for the processing of your personal data, so that we stop using them, as long as it is provided for in the cases of Law 1581 of 2012 and Decree 1377 of 2013.

To do this, it is necessary that you submit your request electronically via email to the following address: privacynotice@jadelrio.com.Your request must be accompanied by your identification and must clearly indicate the personal information for which you wish to revoke the processing consent.

6. Rights of Holders

Any “Holder” of the personal data processed by “JADR” has the following rights provided for in the “Legislation of Personal Data”:

a) Free access to the data provided that have been processed. b) Request the update and rectification of your information against partial, inaccurate, incomplete, fractional data that lead to error, or those whose processing is prohibited or has not been authorized. c) Request proof of the authorization granted. d) File complaints for violations of the provisions of current regulations with the Superintendency of Industry and Commerce (“SIC”). e) Revoke the authorization and/or request the deletion of the data, unless there is a legal or contractual duty that makes it imperative to keep the information. f) Refrain from answering questions about sensitive data or data of children and adolescents.

7. Means of Exercising Rights

In accordance with the "Personal Information Legislation", the "Holder" by himself or through a duly accredited legal representative, may exercise his rights of access, rectification, cancellation or opposition directly before the "Data Controller" "JADR" at the email privacynotice@jadelrio.com .

If the postal service is chosen, you must do so at the following address: Edificio Paralelo 108. Autopista Norte, Av. Carrera 45. No. 108-27, Torre 2, Oficina. 1502. Bogota, Colombia.

I

In all the above cases, "You" or, where appropriate, your legal representative, will be informed of the reason for our decision and we will communicate it, within the deadlines established for this purpose, by the same means by which the request was carried out, accompanying, where appropriate, the relevant evidence.

The maximum term provided by law to resolve your claim is fifteen (15) business days, counted from the day following the date of receipt. When it is not possible to address the claim within said period, JADR will inform the interested party of the reasons for the delay and the date on which its claim will be addressed, which in no case may exceed eight (8) business days following the expiration of the first term. Once the terms indicated by Law 1581 of 2012 and the other regulations that regulate or complement it have been complied with, the Holder who is denied, in whole or in part, the exercise of the rights of access, updating, rectification, deletion and revocation, may bring their case to the attention of the Superintendence of Industry and Commerce -Delegation for the Protection of Personal Data.

8. About Remote Media

"You" understand and agree that: (i) our Website may include links to third-party websites that, if accessed, will cause you to leave our website, for which we will not assume any responsibility in relation to third-party websites; (ii) Our Website may include links to sites that manage social networks, in which case "You" accept that by providing any type of information, including your data on such sites, it will cause it to be read, viewed, accessed, forwarded and processed by any person, releasing us from any responsibility; (iii) It is possible that our systems collect additional data to those that "You" provide, such as the type of browser, the operating system, the internet pages visited, the IP address, etc., through "cookies" or "web beacons", among others. In order to disable these systems, you must access "Internet Options" in the "tools" bar of the browser you use.

9. Policy Modifications

This Policy may be modified by "JADR" as many times as deemed necessary, both to be consistent with the applicable legal systems and at the request of the competent authorities and/or modifications in the data. In the event that there is any substantial change in the Policy, this will be communicated in a timely manner to the holders of the personal data in an efficient manner before implementing the policies, in accordance with Article 13 of Decree 1377 of 2013.

10. Term

This Policy is effective as of June 28, 2023.¹The databases in which the personal data will be recorded will be valid for the same duration as the information is maintained and used for the purposes described in this policy. Once that purpose(s) is fulfilled and as long as there is no legal or contractual duty to retain your information, your data will be deleted from our databases.