PRIVACY NOTICE COLOMBIA

Last Updated: 08-04-2025

JA DEL RÍO, S.A.S. (hereinafter, “JADR” or the “Controller” indistinctly), has the obligation of complying the administrative, legal, and safety measures enough to protect those personal data that it gathers from “You” (hereinafter, “You” or the “Data Subject”) for the purposes described in this Privacy Notice, pursuant to the provisions of Law 1581 of 2012, and Decree 1377 of 2013, and the different set of rules in force and related thereto (the “Legislation of Personal Data”).

JADR binds to ensure the compliance of all legal principles concerning the protection of personal data, and states our commitment to respect this privacy policy at all times, both by us and our collaborators.

The purpose of all of the above is that “You” may have full control and decision on your personal data, in order to guarantee the right to control the access to your own personal data. To this end, we recommend you to read the following information carefully:

1. Identity of the “Controller”:

“JADR”, domiciled in Edificio Ecotower 100, piso 4 oficina 401, Av Calle 100 No 19A- 30, Bogota, Colombia, telephone number +57 (60) 1 443 14 40, and e-mail address privacynotice@jadelrio.com, is responsible for the treatment of the personal data you may provide to us, according to the provisions of this Privacy Notice.

2. Personal Data:

“JADR” will gather from “You” the personal data required to properly provide our services and/or compliance of the purposes of the “Controller”, including the following: (i) name(s), surnames and/or corporate or firm name; (ii) domicile; (iii) land line telephone or cell telephone number; (iv) e-mail address, (v) social media, (vi) tax identification, (vii) copy of official identification, (viii) document evidencing the legal representation of the legal entity, (ix) distinguishing signs, (x) images and/or videos, and/or (xi) testimonies on the Clearly Rated platform, as well as their publication on the webpage of “JADR”.  

“You” commit yourself that the data you may provide to “JADR” are truthful, complete, and accurate. Any false, incomplete or inaccurate data will be your sole responsibility.

3. Purpose of the data treatment:

The purpose of this Privacy Notice is the protection of any information concerning individuals identified or identifiable (the “Personal Data”), such as clients, suppliers, workers, and other third parties related to the Corporation (the “Data Subjects”), regulating the use and protection of Personal Data of the “Data Subjects”, through its legitimate, controlled and informed treatment, in order to guarantee their privacy.

The personal data you may provide to us will be used for “JADR's” own purposes, and the activities related to the development of such purposes which are, by way of enumeration but not limitation, to:

• Maintaining, developing, managing, controlling, and performing the contractual relationship derived from the request and/or contracting of our services.
• Confirming your identity and contact information.
• Creating, ordering, classing, classifying, and storing files and databases of the “Data Subjects”, as well as their accounts.
• Providing information, communications, and notices to the “Data Subject” on our services.
• Carrying out collection activities.
• Providing advisory services, clarifications, and customer services, by phone, e-mail and/or any other media.
• Monitoring the quality of our customer service through calls and/or electronic mail messages and/or any other media, as well as the care offered through such media.
• Statistics and historical register. 
• Fulfilling legal requests from national or foreign competent authorities, and fulfill obligations derived from the legal relationship between “You” and the “Controller” and/or its controlling, affiliate and subsidiary companies.
• Fulfilling any legal provisions and obligations applicable to the “Controller”, its controlling, subsidiary and/or affiliate companies, as well as to manage any of their judicial proceedings.
• The required and/or similar supplementary activities to carry out the foregoing purposes.
• We will treat the Personal Data for the following secondary or ancillary purposes: Talent acquisition, marketing, publicity, promotion, bulletins, data profiling, publicity messages, innovations, invitations to events, searching of new clients, and offering of services, either in general or customized, sent through any other media.

If your do not want the treatment of your personal data for these secondary or ancillary purposes, “You” can follow the procedure indicated in numbered section 6 of this Privacy Notice.

4. Data transfer:  

“JADR”, as controller of the treatment of the Personal Data of “Data Subjects”, is bound to fulfill the principles of legality, consent, information, quality, purpose, loyalty, proportionality, and responsibility provided for in the Law. For such reason, the “Controller” binds to keep the strictest confidentiality regarding the Personal Data of “Data Subjects”.

The above notwithstanding, your Personal Data may be transferred within the national territory or abroad when any of the following events materializes:

a) When the transfer has been set forth in a Law or a Treaty where Colombia is party thereto;

b) When the transfer is made to controlling, subsidiary, affiliate companies, or is subject to the common control with the “Controller”, which operate under the same processes and internal policies as the “Controller”;

c) When the transfer is made to authorities, government bodies or agencies, public notaries and public brokers: (i) in compliance with, or in relation to, the obligations set forth in the legislation applicable to the “Controller”, its controlling, subsidiary and/or affiliate companies, as well as in compliance with the requests made to them; (ii) to comply with obligations derived from a legal relationship between the “Data Subject” and the “Controller”;  (iii) when the transfer is necessary to maintain or fulfill the relationship between the “Controller” and the “Data Subject”, and (iv) concerning the recognition, exercise, or defense of a right of the “Controller”, its controlling, subsidiary and/or affiliate companies in an administrative and/or judicial proceeding;

d) When the transfer is necessary pursuant to an agreement entered into, or to be entered into, in the interest of the “Data Subject”, by the “Controller” and a third party;

e) When the transfer is necessary or legally required to protect public interest, or regarding the representation or administration of justice;

f) When the transfer is made based on other predicates set forth in the Legislation of Personal Data that do not require your consent.

The aforementioned transfers do not require your consent in accordance with the Legislation of Personal Data.

5. Revocation of Consent:

At any time, “You” make revoke the consent granted to us to treat your personal data, so that we cease to use them, provided, however, the above has been set forth in the predicates of Law 1581 of 2012, and Decree 1377 of 2013.

To this end, you are required to submit your request in electronic media through an e-mail message to the following address: privacynotice@jadelrio.com. Your request must be submitted with your identification, and shall clearly state the personal data with respect to which you intend to revoke your consent of such treatment.

6. Procedure to Exercise ARCO Rights:

Pursuant to Law 1581 of 2012, and Decree 1377 of 2013, “Data Subjects”, either by themselves or through a duly accredited legal representative, may exercise their rights of access, rectification, cancellation, or objection directly before the “Controller” of the Treatment “JADR”, in the e-mail address privacynotice@jadelrio.com.

If you elect to submit it through postal mail, you must send it to the following domicile: Edificio Ecotower 100, piso 4 oficina 401, Av. Calle 100 No 19A- 30, Bogota, Colombia.

I) Access.- “You” may request, at all times, to be informed which of your data have been gathered and maintained by the “Controller”.

II) Rectification.- If any of your data is inaccurate or incomplete, you may request their correction, attaching therein the documentation evidencing such modification.

III) Cancellation.- The cancellation of the data may be requested at any time; in case the request is admissible, the data will be subject to a blocking period, when they shall not be treated in any manner, to be subsequently deleted.

“JADR” may keep them exclusively for purposes of the responsibilities derived from the treatment. The blocking period shall be equal to the term of the statute of limitations for actions derived from the legal relationship on which the treatment is based, in terms of the Law applicable to the topic.

Once the data has been cancelled, a notice will be given to its “Data Subject”.

IV) Objection.- The “Data Subjects” may, at any time, refuse the treatment of their personal data due to a justified cause.

The request to exercise Arco Rights shall contain, and be accompanied by, the following: (i) name, corporate or firm name of “Data Subjects”, their domicile and/or e-mail addresses, and any other means to communicate the answer to their requests; (ii) official documents evidencing the identity or, if applicable, the legal representation of “Data Subjects”; (iii) a clear and accurate description of the data with respect to which any of the aforementioned rights is intended to be exercised; and (iv) any other element or document that may make easier to locate the data.

Once the document whereby we have been indicated that the Arco Right will be exercised has been received, we will have 20 business days to analyze, deal, and submit the pertinent answer, and we will fulfill the request, if such request is admissible, within 15 (fifteen) business days following our answer to your request. The means through which we will submit our conclusion shall be the means that “You” have indicated to us in your request, or in absence thereof, through the same means whereby you have submitted your document to us.

“JADR” may deny to the “Data Subjects” the access to their personal data, or to carry out the rectification, cancellation or to grant the objection to their treatment in the following cases:

a) If the applicant, but not the “Data Subject” of the personal data, or the legal representative of such data subject, has not been duly accredited for such purposes.

b) When your personal data are not found in our databases.

c) When the rights of a third party may be harmed.

d) When there exists a legal impediment or a decision from a competent authority restricting the access to your personal data, or that does not allow the rectification, cancellation, or objection thereof.

e) When the rectification, cancellation, or objection has been previously carried out.

In all of the above cases, “You” will be informed or, if applicable, your legal representative, of the reason for our decision, and we will communicate it within the terms established for such purposes through the same means wherein the request was made, attaching therein, if applicable, the pertinent evidence.

7. Of the Remote Media:

“You” acknowledge and accept that: (i) our Website may include links to websites of third parties that, in case of being accessed, may cause you to abandon our website and, to this end, we will not assume any liability in relation to websites of third parties; (ii) our Website may include links to websites that manage social media, in which case “You” accept that, upon providing any type of information, even your data in such websites, this will cause that such data may be read, viewed, accessed, retransferred, and treated by any person, releasing us from any liability; (iii) it is possible that our systems may gather additional data apart from those that “You” may provide, such as the type of browser, operating system, internet webpages visited, IP address, etc., through “cookies” or “web beacons”, among others. To disable such systems, you must access “Internet Options” in the “Toolbar” of any browser you may use.

8. Of the Modifications to the Privacy Notice:

This Privacy Notice may be modified by “JADR” as many times as deemed necessary, both to keep consistency with the applicable legal ordinances, and by request of the competent authorities and/or any modifications in the data. In case of any change to this Privacy Notice, “JADR” will inform it by publishing a visible note on the Website. For your safety, you may review, anytime you wish to do so, the contents of this Privacy Notice on our Website www.jadelrio.com

9. Acceptance of the Privacy Notice: 

If you do not state any objection to the contents and scope of this Privacy Notice or any of its modifications, it shall be understood that you have granted your implied consent so that “JADR” may carry out the treatment of your Personal Data, based on the Purposes of the Treatment established in the Privacy Notice.

10. Disputes:

In case a dispute may arise derived from this Privacy Notice, the parties shall first attempt to solve it through good faith negotiations, and they may be assisted by a professional mediator. If, after a term not exceeding 30 business days of negotiation, the parties fail to reach an agreement, the provisions of Law 1581 of 2012, and of Decree 1377 of 2013 shall be observed. By accepting this Privacy Notice, “You” agree to submit to the jurisdiction and competence of the applicable laws and courts of Bogota, Colombia and waive, henceforth, any other jurisdiction you may be entitled to claim because of your current or future domicile, or for any other reason.