Privacy Policy and Processing of Personal Data

PERSONAL DATA PROCESSING POLICY

A. SCOPE OF APPLICATION OF THE PERSONAL DATA PROCESSING POLICY:

CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, a Colombian company, identified with the Nit 900929414-9, domiciled in the city of Barranquilla at Carrera 59 N° 66 -86 Of 59, hereinafter THE RESPONSIBLE for the processing of your personal data, a company dedicated to providing business consulting, accounting, bookkeeping, financial auditing and tax advisory activities. This policy aims to regulate the processing of the owners of personal data provided or to be provided of EMPLOYEES, SUPPLIERS, PROSPECTS AND CUSTOMERS, which are in databases and files owned by THE RESPONSIBLE PARTY.

CONSULTORÍA ESTRATÉGICA ORGANIZACION SAS, will comply at all times with current regulations on the protection of personal data; Law 1581 of 2012 regulated by Decree 1377 of 2013 and will guarantee the exercise of The Habeas Data Rights of all owners of personal data found in its databases and files, will develop controls and technical, legal and organizational measures aimed at establishing security conditions, in order to prevent access, loss, adulteration and fraudulent use of the data under which it holds the status of RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA.

The purpose of the information obtained and managed in our databases is based on the development of the company's corporate purpose in line with current regulations and regulations, and the information obtained is considered confidential.

B. DEFINITIONS:

In order to help determine in a simple way the meaning of the technical term frequently used in the field of personal data protection, all owners of personal data of which CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, hold the status of RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA, shall understand the following terms as follows:

Authorization: Prior, express and informed consent of the Owner to carry out the processing of personal data. (Source: Statutory Law 1581 of October 17, 2012).

Database: Organized set of personal data that is subject to Processing. (Source: Statutory Law 1581 of October 17, 2012).

Consent of the owner: It is an informed, free and unequivocal manifestation of will, through which the owner of the personal data accepts that a third party may use his or her information.

Consultations: The Owners or their successors may consult the personal information of the Owner that is stored in any database, whether in the public or private sector. The Data Controller or Data Processor must provide them with all the information contained in the individual record or that is linked to the identification of the Data Controller. (Fuente: Ley Estatutaria 1581 del 17 de octubre de 2012).

Data Controller: Natural or legal person, public or private, who, by itself or in association with others, decides on the data database and/or the processing of data. (Source: Statutory Law 1581 of October 17, 2012.

Processing: Any physical or automated operation or procedures that allow personal data to be captured, recorded, reproduced, stored, organised, modified or transmitted.

Data processing: As a general rule, the consent of the owner of the personal data is required to be able to carry out any processing of their data.

Owner of personal data: It is the natural person whose personal data are processed by a third party.

EXERCISE OF RIGHTS BY THE OWNER:

The owner may at any time exercise his/her rights of access, rectification, deletion and proof of authorisation before THE CONTROLLER by sending a written notification, attached photocopy of a document proving your identity, to the addresses indicated below:

Email: gerencia@ceosolucionesbpo.com

Office Address: Cra 59 No 66 86 of 59 Barranquilla - Atlántico

WAYS OF EXERCISING THE RIGHT OF HABEAS DATA

On your own behalf: You, as the owner of personal data found in databases and files of CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, will have the right to know, update, access, rectify, delete, request proof of authorization granted, be informed about the use of your data, revoke the authorization granted.
Exercise of the right through a proxy: This right can be exercised by the duly identified data subject or by the representative of the owner of the personal information (a copy of the power of attorney must be attached with the request). If the request is submitted by a person who is not the owner of the personal information, without complying with the presentation of the appropriate document that supports the representation, it must be considered as not presented and no response will be given to said requirement.
Exercise of the right of minors: Minors must exercise their right of habeas data through the person who accredits their legal representation.

1. CONSULTATION AND COMPLAINT PROCEDURE

The owners of the information, who wish to make inquiries, must take into account that CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, as DATA CONTROLLER, will provide said persons with all the information contained in the individual record or that is linked to the identification of the owner. The query will be made through the channels enabled in numeral C "EXERCISE OF THE RIGHTS OF THE OWNER" of this policy and will be answered within a maximum term of ten (10) business days from the date of receipt of the request.

When it is not possible to respond to the query within said term, the interested party will be informed, stating the reasons for the delay and indicating the date on which the query will be answered, which in no case may exceed five (5) working days following the expiration of the first term, without prejudice to the provisions contained in special laws or regulations issued by the Spaniards.

Complaint Procedure:

The Owner who considers that the information contained in a database of CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, should be subject to correction, updating or deletion, or when he notices the alleged breach of any of the duties contained in Law 1581, may file a claim with the data controller or the data processor, which will be processed under the following rules:

The complaint will be made by means of a request addressed to the data controller or the data processor, with the identification of the owner, the description of the facts that give rise to the claim and the address, together with the documents that you wish to assert.

If the claim is incomplete, the interested party will be required within five (5) days of receipt of the claim to correct the defects. Two months have elapsed since the date of the request without the applicant submitting the required information it will be understood that he has withdrawn the claim.

In the event that the person receiving the complaint is not competent to resolve it, he or she will notify the appropriate party within a maximum period of two working days and will inform the interested party of the situation.

Once the complete claim has been received, within a period of no more than two (2) business days, a legend will be included in the database that says "claim in process" and the reason for it. This legend must be maintained until the claim is decided.

The maximum term for dealing with the claim will be fifteen (15) business days from the day following the date of receipt. When it is not possible to address the claim within that period, the interested party shall be informed of the reasons for the delay and the date on which their claim will be addressed, which in no case may exceed eight working days following the expiration of the first term.

CHANGES TO THE PERSONAL DATA PROCESSING POLICY:

CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS informs that, in the event of introducing any change in the privacy procedures and policies, these will be informed through their publication on the website www.ceosolucionesbpo.com The above in order to keep all owners informed and updated on the conditions of use of their personal data.

In the event that this policy is not available on its website, CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, will guarantee that the owners who wish to consult it have access to it by sending it by email or certified mail. Likewise, at the time changes are made to this policy, CONSULTORÍA ESTRATÉGICA ORGANIZACION SAS will be responsible for informing them.

GUIDING PRINCIPLES OF PERSONAL DATA PROTECTION APPLIED IN THE PROCESSING OF PERSONAL DATA:

STRATEGIC ORGANIZATIONAL CONSULTING SAS is committed to maintaining the freedom, integrity, transparency, confidentiality, veracity and availability of the personal data of EMPLOYEES, SUPPLIERS, PROSPECTS AND CUSTOMERS and any other natural person who maintains their data in our databases and files. STRATEGIC ORGANIZATIONAL CONSULTING SAS, guarantees the application of the general principles for the processing of this type of data, contemplated in Law 1581, which are:

LEGALITY IN TERMS OF DATA PROCESSING. The processing of personal data is a regulated activity, so the company will mandatorily comply with the provisions of Law 1581 and the other provisions that develop it.

PURPOSE. CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, will apply treatment to personal data, always obeying a legitimate purpose, which will be previously informed to the owner.

FREEDOM. The company will only process personal data when it has the prior, express and informed consent of the owner.

VERACITY OR QUALITY. The personal data processed by the company must be truthful, complete, accurate, updated, verifiable and understandable.

TRANSPARENCY. CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, will guarantee the owner of the personal data, at any time and without restrictions, the obtaining of information about the existence of data that concerns him/her.

RESTRICTED ACCESS AND CIRCULATION. CONSULTORÍA ESTRATÉGICA ORGANIZACION SAS, undertakes that the processing of personal data will be carried out by entities authorized by the owner and/or by the persons provided for in Law 1581. Personal data may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide knowledge restricted only to the owners or third parties.

SAFETY. The information subject to processing by CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, will be handled with the technical, human and administrative measures necessary to provide security to the records, preventing their adulteration, loss, consultation, use or unauthorized or fraudulent access.

CONFIDENTIALITY. CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, undertakes that the persons involved in the processing of personal data that are not public will be obliged to guarantee the confidentiality of the information, even after the end of their relationship with any of the tasks included in the processing, being able to only provide or communicate personal data when this corresponds to the development of the authorized activities.

CONSENT AND REVOCATION

CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, informs that, through free, prior, express and informed authorization, you as the owner of personal data, authorizes your personal data to be collected, stored, transmitted, used, updated, circulated and in general processed in accordance with the purposes listed in this PERSONAL DATA PROCESSING POLICY.

Any owner may at any time revoke their consent for the processing of their data, provided that it is legally and/or contractually permitted, by sending a communication and/or request through the channels that appear in numeral C "EXERCISE OF THE RIGHTS OF THE OWNER" of this policy, providing a copy of their identification document (ID and/or passport) in order to prove their identity.

DUTIES OF STRATEGIC ORGANIZATIONAL CONSULTING SAS AS RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA BEFORE THE DATA PROTECTION AUTHORITY:

CONSULTORÍA ESTRATÉGICA ORGANIZACION SAS as the data controller must comply with the following duties, without prejudice to the other provisions provided for and in others that govern their activity:

To guarantee to the Owner, at all times, the full and effective exercise of the right of habeas data;

Request and keep, under the conditions provided by law, a copy of the respective authorization granted by the Owner;

Duly inform the Owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted;

To keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access;

To ensure that the information provided to the Data Processor is truthful, complete, accurate, up-to-date, verifiable and understandable;

Update the information, communicating in a timely manner to the Data Processor, all the news regarding the data that has previously been provided to it and adopt the other necessary measures so that the information provided to it is kept up to date;

Rectify the information when it is incorrect and communicate the pertinent information to the Data Processor;

Provide the Data Processor, as the case may be, only data whose Processing is previously authorized in accordance with the provisions of the law;

Require the Data Processor at all times to respect the security and privacy conditions of the Owner's information;

To process the queries and complaints formulated in the terms indicated in this law;

Adopt an internal manual of policies and procedures to ensure adequate compliance with the law and, in particular, for the attention of queries and complaints;

Inform the Data Processor when certain information is under discussion by the Data Controller, once the complaint has been filed and the respective procedure has not been completed;

Inform, at the request of the Owner, about the use given to their data;

Inform the data protection authority when there are violations of security codes and there are risks in the management of the information of the Holders.

Comply with the instructions and requirements issued by the Superintendence of Industry and Commerce.

SENSITIVE PERSONAL DATA CONTEMPLATED IN LAW 1581 OF 2012.

The processing of personal data of children applied by CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, will always be carried out respecting the following requirements:

Always respond to and respect the best interests of children and adolescents.

Always ensure that the person responsible respects their fundamental rights.

That as far as possible, such processing is carried out taking into account the opinion of the minors who are the owners of the personal information, considering the following factors:

Maturity

Autonomy

Ability to understand the purpose of such processing

Explain the consequences of treatment

CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, or any person in charge or third party involved in the processing of the personal data of minors, must always ensure the appropriate use of this type of personal data.

The owners of personal data, in accordance with current regulations on the protection of personal data, are not obliged to authorize the processing of their sensitive data; however, in cases where such data is necessary, CONSULTORÍA ESTRATÉGICA ORGANIZACIONAL SAS, must obtain explicit consent to process such data.

CONSULTORIA ESTRATEGICA ORNIZACIONAL SAS, identify the sensitive data that it may collect or store in order to fulfill the following objectives:

To pay special attention to and reinforce its responsibility regarding the processing of this type of data from its suppliers.

VALIDITY
This Policy and Procedures are in force from October 01, 2022 indefinitely until the issuance of others or a substantial change thereof.