Privacy and data processing policies

DATA PROCESSING POLICY

In compliance with the provisions contained in article 15 of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013, and other regulations that modify, add, complement or develop it, HELENICA, committed to respecting and guaranteeing the rights of its clients, suppliers, employees and third parties in general, discloses the policies and procedures for the processing of personal data that are stored and safeguarded in our database, which are mandatory in all activities that involve, totally or partially, the collection, storage, use, circulation and/or transfer of such information.

This Personal Information Processing Policy is mandatory for HELENICA, as the data controller, as well as for all allied companies, subsidiaries or those that are part of the business group of this company.

Legal framework

This Personal Information Processing Policy is based on Article 15 of the Political Constitution, Law 1581 of 2012, Regulatory Decree 1377 of 2013, which provide:

• Political Constitution, Article 15. “All persons have the right to their personal and family privacy and to their good name, and the State must respect them and ensure that they are respected. Likewise, they have the right to know, update and rectify the information that has been collected about them in databases and in the archives of public and private entities.
• In the collection, processing and circulation of data, freedom and other guarantees enshrined in the Constitution will be respected.
• Correspondence and other forms of private communication are inviolable. They may only be intercepted or recorded by court order, in the cases and with the formalities established by law.
• For tax or judicial purposes and for cases of inspection, surveillance and intervention by the State, the presentation of accounting books and other private documents may be required, in accordance with the terms established by law.”
• Statutory Law 1581 of 2012 “By which general provisions are dictated for the protection of personal data.”
• Regulatory Decree 1377 of 2013 “By which Law 1581 of 2012 is partially regulated”-
• General information about HELENICA as a data controller

Company name: HELENICA

NIT: 25.279.320-1

Address: Cra 1 Oeste # 1B - 60 L8 / CC Casa del Río Oeste - Cali - Colombia.

Phone: +57 301 6809646

Email: gerencia@helenica.co

Website: www.helenica.co

PURPOSE OF THE PERSONAL DATA PROCESSING POLICY

The Personal Data Processing Policy aims to develop and make known to the general public the corporate and legal guidelines under which HELENICA processes personal data, the purpose of the processing, the rights of the holders, as well as the internal and external procedures that exist for the exercise of such rights before HELENICA, among others.

Legal Definitions

For the purposes of the execution of this policy and in accordance with legal regulations, the following definitions will apply:

• Authorization: Prior, express and informed consent of the Owner to carry out the Processing of personal data;
• Database: Organized set of personal data that is subject to processing;
• Owner: Natural person whose personal data is subject to processing, whether a client, supplier, employee, or any third party who, by virtue of a commercial or legal relationship, provides personal data to HELENICA.
• Treatment: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
• Personal data: Any information linked to or that can be associated with one or more specific or identifiable natural persons;
• Public data: Data that is not semi-private, private or sensitive. Public data includes, among others, data relating to the civil status of individuals, their profession or occupation and their status as a merchant or public servant. By its nature, public data may be contained in, among others, public records, public documents, official gazettes and bulletins and duly executed court rulings that are not subject to confidentiality.
• Sensitive data: Sensitive data is understood to be data that affects the privacy of the Owner or whose improper use may lead to discrimination, such as data that reveals racial or ethnic origin, political orientation, religious or philosophical beliefs, membership in unions, social organizations, human rights organizations or that promote the interests of any political party or that guarantee the rights and guarantees of opposition political parties, as well as data relating to health, sexual life, and biometric data.
• Transfer: Data transfer takes place when the Controller and/or Processor of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is the Controller and is located within or outside the country.
• Transmission: Processing of personal data that involves the communication of the same within or outside the territory of the Republic of Colombia when its purpose is to carry out Processing by the Processor on behalf of the Controller.

When a term is defined in this Information Processing Policy, reference shall be made to that definition. Likewise, when a term is not expressly defined in this document or in the applicable Law, the literal meaning of the stipulations shall apply, provided that such interpretation is consistent with the purpose of the Information Processing Policy.

Principles governing HELENICA's actions in the processing of personal data

The principles governing the processing of personal data by HELENICA are as follows:

• Principle of legality: The processing of personal data is a regulated activity that must be subject to the provisions of Law 1581 of 2012, Decree 1377 of 2013 and other provisions that develop them.
• Principle of purpose: the purpose of the Treatment must be legitimate, and informed to the owner.
• Reasonable Limit Principle: The storage and processing of personal data will be limited to what is essentially necessary to fulfill the previously specified purposes of the business relationship, as well as the fulfillment of the purposes authorized by the Owner.
• Principle of freedom: personal data may only be processed with the prior, express and informed consent of the Owner or by legal or judicial order.
• Principle of truthfulness: the information must be true, complete, accurate, up-to-date, verifiable and understandable.
• Principle of transparency: the right of the Owner to obtain information about his/her personal data whose Processing is carried out by HELENICA must be guaranteed.
• Principle of Restricted Access and Circulation: Processing may only be carried out by persons authorized by the Owner or by the persons provided for by Law.
• Security Principle: Information must be handled with the necessary measures to ensure the security of records and prevent their adulteration, loss, consultation, use or unauthorized or fraudulent access.
• Confidentiality Principle: personal data that are not public in nature are confidential and can only be provided under the terms of the Law.
• Principle of systematic incorporation: the principles of Personal Data Protection will be implemented in all processes and procedures of HELENICA's commercial activity.

Rights of the holders of personal data

• To know, update and rectify your personal data with regard to the Data Controllers or Data Processors. This right may be exercised, among others, in relation to partial, inaccurate, incomplete, fragmented data that may lead to error, or data whose processing is expressly prohibited or has not been authorized;

• Request proof of the authorization granted to the Data Controller, except when it is expressly excepted as a requirement for the Treatment, in accordance with the provisions of article 10 of this law;

• Be informed by the Data Controller or the Data Processor, upon request, regarding the use that has been given to your personal data;

• Submit complaints to the Superintendency of Industry and Commerce for violations of the provisions of this law and other regulations that modify, add to or complement it;

• Revoke the authorization and/or request the deletion of the data when the Processing does not respect the constitutional and legal principles, rights and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that in the Processing the Controller or Processor has engaged in conduct contrary to this law and the Constitution;

• Access free of charge to your personal data that has been subject to processing.

AUTHORIZATION FOR THE PROCESSING OF PERSONAL DATA

HELENICA, acting as Data Controller, has adopted procedures to request, at the latest at the time of collecting your personal data, your authorization for the Processing of the same and to inform you of which personal data will be collected as well as all the specific purposes of the Processing for which your consent is obtained.

The Data Subject shall be deemed to have granted HELENICA Authorization to Process his/her personal data when this is expressed: (i) in writing; (ii) orally; or (iii) through unequivocal conduct by the Data Subject that reasonably allows us to conclude that he/she has granted HELENICA the respective authorization. In no case shall silence be understood as unequivocal conduct.

Notwithstanding the foregoing, the authorization of the Owner shall not be necessary in the case of: (i) Information required by a public or administrative entity in the exercise of its legal functions or by court order; (ii) Data of a public nature; (iii) Cases of medical or health emergency; (iv) Processing of information authorized by law for historical, statistical or scientific purposes; and (v) Data related to the Civil Registry of Persons.

Revocation of authorization and/or deletion of data

The Owner of the personal data may at any time request HELENICA, as Data Controller, to delete his/her personal data and/or revoke the authorization he/she has granted for the Processing of the same, by submitting a claim, in accordance with the provisions of Article 15 of Law 1581 of 2012.

Notwithstanding the foregoing, we advise that the request for deletion of information and/or revocation of authorization will not proceed when, as the Owner of the personal data, you have a legal or contractual obligation under which it must remain in the HELENICA database.

Purpose of processing personal data

HELENICA will process personal data for the following purposes:

• Carry out, through any means directly or through third parties, marketing, promotion and/or advertising activities, whether our own or those of third parties, sales, billing, collection management, collection, programming, technical support, market intelligence, service improvement, verifications and queries, control, behavior, habit and enabling of payment methods, fraud prevention, as well as any other activities related to our current and future products and services, for the fulfillment of contractual obligations and our corporate purpose.
• Generate optimal communication in relation to our services, products, promotions, billing and other activities.
• Evaluate the quality of our products and services and conduct studies on consumer habits, preferences, purchasing interest, product testing, concept, service evaluation, satisfaction and others related to our services and products.
• Provide assistance, service and technical support for our products and services.
• Carry out the necessary steps to comply with the obligations inherent to the services provided by HELENICA.
• Comply with the obligations contracted with our clients, allies, users, suppliers, their subsidiaries, distributors, subcontractors and other persons directly or indirectly related to the corporate purpose of HELENICA.
• Control and prevent fraud in all its forms.

Procedure for handling requests and queries related to personal information

The owner of the personal data or whoever is duly authorized may:

• Make requests and queries to know the personal information of the Owner held by HELENICA.
• Request the update, modification, rectification or deletion of the Owner's data, when appropriate in accordance with this Policy and the applicable Law.
• Request a copy of the authorization granted by the Owner to HELENICA to process your Personal Data.

These queries may be made free of charge at least once each calendar month and whenever there are substantial modifications to the Information Processing Policies that motivate new queries.

The Owner or whoever is authorized to do so, may make inquiries to HELENICA about the Owner's personal information through the following mechanisms:

Email: gerencia@helenica.co

The query will be answered within a maximum period of ten (10) business days from the date of receipt thereof.

When it is not possible to respond to the query within the term indicated above, HELENICA will inform the interested party, stating the reasons and indicating the date on which the query will be responded to, no later than within five (5) business days following the expiration of the first term.

Procedure for handling complaints and revoking authorization for the processing of personal data

Through this procedure, the Owner or whoever is duly authorized may:

• Revoke Authorization for Data Processing.

• File complaints when you consider that there is an alleged breach of HELENICA's duties related to the Processing of Personal Data, in accordance with the provisions of these Policies or the Personal Data Protection Law.

• Revocation of the Owner's Authorization for the Processing of Personal Data.

The Owner may revoke the authorization and request the deletion of his/her data in the following events:

• By unilateral, free and voluntary decision of the Data Subject, when there is no legal or contractual obligation that imposes on the Data Subject the duty to remain in the database; and
• When the constitutional and legal principles, rights and guarantees are not respected, provided that the Superintendency of Industry and Commerce has determined that in the Treatment the Controller or Manager has engaged in conduct contrary to the law.

The above is without prejudice to the rules that HELENICA must observe regarding document retention for the fulfillment of formal obligations. Consequently, HELENICA will delete the data or suspend its use when appropriate, respecting the rules on document retention that apply to it.

The procedure for handling complaints about the personal data of the Owner is as follows:

The Data Controller or whoever is duly authorized to do so, may make claims to HELENICA in relation to the Processing of their Personal Data, in the following events:

• When you consider that the Owner's information contained in a database should be corrected, updated or deleted.
• When you become aware of the alleged breach of any of the duties contained in the Data Protection Act.

Complaints must be submitted through any of the following channels:

Verbally by contacting the Customer Service Line in Popayán at +57 301 6809646

By writing to the following address: Cra 1 Oeste # 1B - 60 L8 / CC Casa del Río Oeste in the city of Cali - Colombia or by email to the address: gerencia@helenica.co

The claim submitted by the Data Subject or by the person authorized to do so, must contain at least the following: (i) Identification of the Data Subject; (ii) Description of the facts that give rise to the claim; (iii) Contact information and location of the Data Subject (address, telephone, cell phone, email, etc.); and (iv) Documents or evidence that support the claim. If the above information is not available, it will be understood that the claim is not complete.

If the claim is incomplete, HELENICA will request the interested party to correct the deficiencies or send the information or documentation required within five (5) business days following receipt of the claim by HELENICA. After two (2) months from the date of the request, if the applicant does not submit the required information, it will be understood that the claim has been withdrawn and it will be archived.

HELENICA has a term of fifteen (15) business days to address the claim, counted from the business day following the date of receipt at HELENICA.

When it is not possible to address the claim within the aforementioned term, HELENICA will inform the interested party of the reasons for the delay and the date on which their claim will be addressed, which may not exceed eight (8) business days following the expiration of the first term.

Area Responsible for Attention to Requests, Queries and Complaints

The HELENICA Customer Service area is responsible for receiving requests, queries and complaints from the Data Subject related to their rights to know, update, rectify and delete Personal Data and revoke Authorization. Likewise, the Customer Service area will ensure that each of the HELENICA areas issues a timely and adequate response to requests, queries and complaints from Data Subjects.

Validity of the personal information processing policy:

This personal information processing policy is effective from November 1, 2019 until such time as it is expressly revoked or modified.