Privacy Policy fo Personal Data Protection.

In accordance with 1581 of 2012 Act and Decree 1377 of 2013 and other applicable regulations, (the “Law”), and with the purpose of protecting personal data of third parties in possession of the corporation JA DEL RIO S.A.S., (the “Corporation”) with the following domicile: Parallel Building 108, Autopista Norte, Av. Carrera 45. No. 108-27, Tower 2, Office. 1502. Bogotá, Colombia. this Privacy Policy (the “Privacy Policy”) is established in accordance with the following terms:

Purposes of Data Processing.

This Privacy Policy is intended to protect any information regarding identified or identifiable individuals (the “Personal Data”) such as customers, suppliers, employees and other third parties related to the Corporation (the “Holders”) by regulating the use and protection of the Personal Data of Holders through its legitimate, controlled, and informed processing in order to guarantee its privacy, as well as the Holders’ right to control access to their personal data.

The Holders agree and authorize the Corporation to use and process in an automated manner its Personal Data and any information provided, which shall be part of the database of the Corporation, with the purposes of using them, including but not limited to: (i) identifying, locating, contacting, and sending the information of the Holder regarding the services provided by the Corporation, (ii) providing service requests, (iii) sending notifications, notices, and information regarding the services provided by the Corporation to Holders, (iv) creating and updating databases for internal, administrative, production processes, marketing, and statistical purposes, and (v) other related matters. The use of Personal Data shall be related to the kind of interaction that the Holder has with the Corporation, whether civil, commercial, or any other kind.

Security Measures to guarantee the protection of Personal Data.

The Corporation, as the responsible party of processing Personal Data of Holders, is obligated to comply with the principles of lawfulness, consent, information, quality, purpose, loyalty, proportionality and responsibility as established by Law. For that reason, the Corporation agrees to keep in strict confidentiality the Personal Data of the Holders, as well as to keep the administrative, technical and physical security measures that allow for the said protection against any damage, loss, alteration, access, use, disclosure or non- authorized processing.

Notwithstanding the foregoing, the Personal Data of the Holders may be transferred for the purposes established in this Privacy Notice to other subsidiary companies within the Corporation group that may be located within or outside of Colombia. The said transfers may be carried out in accordance with the Law and other regulatory requirements to guarantee that the Personal Data of the Holders is adequately protected.

Means to exercise the rights of access, rectification, cancellation or objection to the rights of Personal Data.

The time during which the Personal Data of the Holders can be handled shall be indefinite, as of the date in which the Holders provide that information to the Corporation, being able to oppose the handling of the same, at any moment deemed appropriate, in accordance with the Law.

Likewise, Holders of the Personal Data shall be entitled, at any time, to exercise their rights of access, rectification, cancellation, or objection to the processing of their Personal Data, through a request via e-mail addressed to privacynotice@jadelrio.com; with attention to the Head of the Department of Protection of Personal Data, or by a written notification to the address of the Company. Likewise, the Holders may contact the Company directly at the following number +57 (1) 3832288.

The access, rectification, cancellation or objection request of Personal Data shall contain and be accompanied by the following:

1. Name and domicile of the Holder or other kind of communication that provides notification of the answer to the request;
2. The documents that prove the identity of the Holder or, when appropriate, the legal representation of the person that carried out the request;
3. A clear and precise description of the Personal Data related to those who seek to exercise any of the aforementioned rights; and
4. Any other element of document that facilitates the location of its Personal Data.

In case of requesting rectification of Personal Data, in addition the Holder or its representative shall indicate the changes to be made and provide the documents that support such a request.

The Corporation shall inform the Holder, in a maximum period of twenty days, as of the date in which the access, rectification, cancellation or objection request was received, of the decision that was adopted, to the effect that, if it is applicable, be made effective within the following fifteen days as of the date in which the answer is communicated. Nevertheless, the said period may be extended once for an equal period when justified by the circumstances of the case.

Process to communicate the Holders about changes in the Privacy Policy.

The Corporation reserves the right to modify and/or change the Privacy Policy at any time, making the said changes available to Holders in the webpage of the Corporation.

In the absence of any expressed ruling in this Privacy Policy and of the Law, the regulations of the Federal Code of Civil Procedures and of the Federal Law of Administrative Procedures shall apply in a supplementary manner.