1. GENERAL

GONZALEZ LAWYERS GROUP S.A.S. is a legally constituted company, identified with NIT 900406324 - 1 with its main address in the city of Barranquilla (Atlántico), located at Carrera 64b No. 84-105 and telephone number 3008010300, whose corporate purpose is focused on the development of legal activities, especially that of providing legal advice to natural and legal persons domiciled within the Colombian territory.

GONZALEZ LAWYERS GROUP S.A.S. It is committed to the protection of private and confidential information that is obtained within the ordinary course of its business in developing its respective corporate purpose. It is a company committed to the safekeeping and correct handling of the personal data of all its clients , suppliers, contractors, employees and the general public, for the sake and in order to strictly comply with current regulations, especially with the provisions for the protection of Personal Data, contained in Law 1581 of 2012, Decree 1377 of 2013 provisions which are intended to guarantee the constitutionally protected right that all people have to know, update and rectify the information that has been collected about them in databases or files, by public or private entities, where the political constitution guarantees the respect that must exist in the collection, treatment and circulation of data.

This information can be obtained, among others, through any of the following channels or means: i) commercial or professional relationship with the respective Client, Provider or other third parties; ii) employment relationship with Employees and Former Employees; iii) Application to selection processes; iv) Attendance at trainings, seminars or courses, among others; v) sending emails requesting information; and vi) electronic resources or platforms used by Deloitte Companies in Colombia, among others.

The personal information that is supplied, delivered or sent to the Company will be used in accordance with this Policy for the Treatment of Personal Data and the Holder accepts it. It is clear that the data provided will not be used for activities or purposes other than those provided herein. In any case, in the event that said personal information is used for other purposes, its use must be covered by any of the exceptions that the regulations provide on the subject or have the express authorization of the Holder, which are listed in the Section V, literal c of this Policy.

This document refers to the security of the information in the custody of the company considering that said information may be contained in physical, digital and / or digitized documents. Thus, GONZALEZ LAWYERS GROUP S.A.S. It is allowed to present the Data Treatment Policy regarding the protection of Personal Data of the Company, in relation to the collection, use and transfer thereof.

2. LEGAL FRAMEWORK

1. Political Constitution, article 15.
2. Law 1266 of 2008
3. Law 1581 of 2012
4. Regulatory Decrees 1727 of 2009 and 2952 of 2010, Regulatory Decree 1377 of 2013 and the Sole Regulatory Decree of the Commerce, Industry and Tourism Sector 1074 of 2015.
5. Resolutions and External Circulars issued by the Superintendency of Industry and Commerce in relation to the National Registry of Databases.

3. DEFINITIONS

For the purposes of this Policy and in accordance with current regulations regarding the protection of personal data, some definitions are presented to facilitate a better understanding of the document:

• Authorization: Prior, express and informed consent of the owner to carry out the processing of personal data.

• Notice of Privacy: It is the physical, electronic document or in any other format, addressed to the Holder for the Treatment of their personal data, by means of which they are informed about the existence of the information Treatment policies that will be applicable, the way to access to the same and the purposes of the Treatment that is intended to give the personal data.

• Database: Organized set of personal data that is subject to Treatment.

• Client: Natural or legal person to whom the company provides legal services by virtue of a pre-existing commercial or civil relationship. The data of the natural or legal persons linked to the Clients are processed by the company by virtue of the existing legal relationship between the parties.

• Personal data: Any information linked to or that may be associated with one or more specific or determinable natural persons.

• Sensitive data: That data that affects the privacy of the Holder or whose improper use may generate discrimination, such as those that reveal racial or ethnic origin, political orientation, religious or philosophical convictions, membership of trade unions, social organizations, human rights or that promotes the interests of any political party or that guarantees the rights and guarantees of opposition political parties as well as data related to health, sexual life and biometric data.

• Employee: Natural person who provides personal services to the company under an employment contract.
•  
• Responsible for the treatment: Natural or legal person, public or private, that by itself or in association with others, carries out the processing of personal data on behalf of the person responsible for the treatment.

• Habeas Data: Law of any person to know, update and rectify the information that has been collected about them in the data bank and in the files of public and private entities.

• Data Protection Act: It is Law 1581 of 2012 and its regulatory decrees or the rules that modify, complement or replace them.

• Provider: Natural or legal person that supplies goods and / or services to the company by virtue of a pre-existing commercial relationship. The data of the natural or legal persons linked to the Suppliers are processed by the company by virtue of the existing legal relationship between the parties.

• Responsible for the treatment: Natural or legal person, public or private, that by itself or in association with others, decides on the database and / or Treatment of the data.

• Data protection officer: It is the person within GONZALEZ LAWYERS GROUP S.A.S. whose function is to monitor and control the application of the Personal Data Protection Policy, under the guidance and guidelines of the Steering Committee. The company will appoint the Data Protection Officer.

• Headline Natural person whose personal data are subject to Treatment.

• Treatment: Any operation or set of operations on personal data, such as the collection, storage, use, circulation or deletion.

• Transfer: The transfer of data takes place when the person in charge and / or in charge of the processing of personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the treatment and is inside or outside the country. .

• Transmission: Treatment of personal data that implies the communication of the same within or outside the territory of the Republic of Colombia when it is intended to carry out a treatment by the person in charge on behalf of the person in charge.

4. GUIDING PRINCIPLES

GONZALEZ LAWYERS GROUP S.A.S. will apply the following specific principles that are established below, which constitute the rules to be followed in the collection, handling, use, treatment, storage and exchange of personal data:

• Principle of legality: In the use, capture, collection and processing of personal data, the current and applicable provisions that govern the processing of personal data and other related fundamental rights will be applied.

• Principle of freedom: The use, capture, collection and processing of personal data can only be carried out with the prior, express and informed consent of the Owner. Personal data may not be obtained or disclosed without prior authorization, or in the absence of a legal, statutory, or judicial mandate that relieves consent.

• Principle of purpose: The use, capture, collection and processing of personal data to which you have access and are collected and collected by the company, will be subordinate and serve a legitimate purpose, which must be informed to the respective owner of personal data.

• Principle of truthfulness or quality: The information subject to use, capture, collection and processing of personal data must be truthful, complete, exact, updated, verifiable and understandable. Processing of partial, incomplete, fractioned or misleading data is prohibited.

• Principle of transparency: In the use, capture, collection and processing of personal data, the right of the Holder to obtain from the company, at any time and without restrictions, information about the existence of any kind must be guaranteed. of information or personal data that is of interest or ownership.

• Principle of access and restricted circulation: Personal data, except public information, may not be available on the Internet or other means of dissemination or mass communication, unless access is technically controllable to provide restricted knowledge only to the Holders or authorized third parties. For these purposes, the obligation of the company will be a medium.

• Security principle: The personal data and information used, captured, collected and subject to treatment by the company, will be protected to the extent that technical resources and minimum standards allow it, through of the adoption of technological protection measures, protocols, and all kinds of administrative measures that are necessary to grant security to the electronic records and repositories, avoiding their adulteration, modification, loss, consultation, and in general against any use or access not authorized.

• Principle of confidentiality: Each and every one of the people who administer, manage, update or have access to information of any kind found in Databases or Data Banks, undertake to conserve and maintain in a manner strictly confidential and not disclose to third parties, all personal, commercial, accounting, technical, commercial or any other information supplied in the performance and exercise of their functions. All people who currently work or are linked in the future for this purpose, in the administration and management of databases, must subscribe an additional document or other to their employment or service provision contract in order to ensure such commitment. This obligation persists and is maintained even after the end of your relationship with any of the tasks that the Treatment comprises.

5.   FINALIDAD DEL TRATAMIENTO DE LOS DATOS PERSONALES

Based on what is described in the objective of this Personal Information Treatment Policy, GONZALEZ LAWYERS GROUP S.A.S. states that there is a diligent, responsible and legal treatment of the personal data collected and informs all members of its interest groups that there are specific purposes that are intended to be given to them, taking into account the relationship or the link that the owner of the information may have with the company. Likewise, and without prejudice to said purposes, the company may treat personal data in order to establish a contractual relationship with the firm, carry out professional training activities, social and professional responsibility activities, events, preparation of commercial and informative material and to maintain the security of the facilities, people and goods.

In that order of ideas, stakeholders are understood to be CUSTOMERS, SUPPLIERS, CONTRACTORS, EMPLOYEES AND FORMER EMPLOYEES.

5.1. Customers

The company may carry out the Treatment of personal information about its Clients for the purposes of linking and providing the professional services hired by them, in accordance with the respective corporate purpose. For this reason, the contracts that are signed with Clients will be governed by the provisions of this Policy, or will include a clause that regulates the Treatment of the information accessed by virtue of it. The data that is collected by the company may, eventually, be shared with third parties or authorities that exercise the company in Colombia in order to develop quality reviews, carry out audits, supervision activities or in order to comply with the standards quality regarding the services contracted by the Client.

There will be collection, storage, copying, delivery, updating, ordering, classification, transfer, correction, verification, use for statistical purposes, loyalty and retention and in general use and use of all data provided for the purpose of developing the corporate purpose of the Company and the provisions of the respective contracts and / or commercial and civil documents signed between the parties.

In exercise of the principle of good faith, the company will assume that the personal information of third parties, whose Responsible Party is the Client, that any of the Companies must know by reason or on the occasion of the provision of the services contracted by the Client, has been processed in strict adherence to the provisions of Law 1581, and Decree 1074 of 2015 or current legislation. The foregoing includes that their data have been processed with the authorization of their Owner, and that said authorization empowers the Client to seek the Treatment of the data by the company. In any case, the personal data of third parties whose Responsible Party is the Client will be processed within the framework of the object of the services contracted by the Client, in order to comply with the commercial relationship that the company has established with the Client.

In conclusion, the Company may carry out the processing of the personal information of its current or future Clients and those Clients with whom its commercial relationship has ended, in order to send them information that in the opinion of the company may be of interest to them. ; as well as, among others, inviting them to events organized by the company; refer

bulletins, sectorial reports or publications and, in general, use the data for the development of the activities included in the company's corporate purpose.

5.2. Suppliers and Contractors

The company will carry out the Treatment of the personal information of its Suppliers and Contractors in order to comply with the obligations acquired by virtue of the respective relationship.

In relation to Suppliers and Contractors, such obligations include, among others, evaluating their performance; establish, manage or terminate commercial or civil relationships verify references; provide the business metrics, and the others that are established in the agreements or contracts signed with the respective Supplier or contractors.

The treatment of the data collected by virtue of the provisions of this section will be carried out and will be in force as long as the purpose for which the respective data was collected is maintained.

Similarly, the company may carry out the treatment of personal data in order to organize, promote and carry out, among others, social events and activities of any kind and nature.

The data will also be processed for the following purposes:

• Payment of contractual obligations,
• Report to government entities,
• Delivery of information to governmental or judicial entities that require it,
• Support in external and internal audit processes,
• Any other purpose that results in the development of the contract in the event of a contract.

5.3. Employees

The company will carry out the Treatment of personal information of its employees and their family nucleus in order to comply with the obligations that emanate from the respective labor relations. Such obligations include, among others, payroll payments, granting of benefits, performance evaluations, improvement of training programs, among others.

In the same way, the company may carry out the processing of the personal data of its employees and their respective families in order to organize, promote and carry out, among others, social events and activities of any kind and nature. Likewise, you may use the use of text messages, e-mails, or any other means that is considered pertinent for the fulfillment of your purposes.

The information collected from employees is also used to carry out a process of analysis, evaluation and selection of personnel to work in the company.

• The employee authorizes GONZALEZ LAWYERS GROUP S.A.S. to process the personal data that is provided in the development of the employment relationship, during the entire time of permanence in the entity and after the relationship has ended as long as there is a legal or contractual conservation duty on the part of GONZALEZ LAWYERS GROUP S.A.S.
• The authorization for the processing of personal data is granted by the employee within what is described in this Personal Data Protection Policy, which is known and complies with the provisions of Law 1581 of 2012.
• Similarly, the employee who, without being empowered to do so, destroys, damages, deletes, deteriorates, alters or deletes computer data, or an information processing system or its logical parts or components, may be criminally denounced for the crime of computer damage. Likewise, the employee who, without being empowered to do so, for his own benefit or that of a third party, obtains, compiles, subtracts, offers, sells, exchanges, sends, buys, intercepts, discloses, modifies or uses personal codes, personal data contained in files, archives, databases or similar means, may be denounced for the conduct of violation of personal data. The breach of these Personal Data Protection Policies adopted and published by GONZALEZ LAWYERS GROUP S.A.S. will be considered a serious offense. becoming a cause for suspension or termination of the employment contract. (In all cases, the employee may make use of their Habeas Data rights (Know, update and rectify his information) with the exception of what is established by law.

5.4. Former employees

The information of former employees is stored for the purposes of documentary preservation and archiving information related to aspects of social security, pension and employment history, during the term established in the labor law. The purpose of this file will: (i) Serve as a basis for the issuance of the labor certificates referred to in Article 57, numeral 7 of the Substantive Labor Code, at the request of the former employee or his successor in title; (ii) Serve as a basis for the granting of employment references to potential employers of the former employee, when the latter so authorizes it at the time of their separation from any of the companies; and / or iii) the information stored in this file may be

study, analyze and used by the company in order to consider the former employee in the personnel hiring processes carried out by the company.

6. PROCEDURE FOR THE TREATMENT OF PERSONAL DATA

All the Personal Data that are collected in the Databases of GONZALEZ LAWYERS GROUP S.A.S. They derive from the exercise of licit activities carried out as a result of commercial, contractual, labor agreements or of any other nature with its users, clients, suppliers, contractors, employees and / or the general public.

For this, the company uses information reception channels such as a website, social networks, telephone or face-to-face service lines, commercial, civil and labor contracts, among others, these are the means through which GONZALEZ LAWYERS GROUP SAS Obtain the Personal Data referred to in this Policy.

The Personal Data collected by the Company are stored electronically, guarded by competent authorized personnel by the company, which allows adequate protection of the information.

7. TREATMENT OF SENSITIVE DATA

Sensitive data is understood to be those whose improper use may affect the Owner's privacy or generate discrimination, among other information related to racial or ethnic origin; political orientation; religious or philosophical convictions; membership in unions, social organizations, as well as data related to health, sexual life and biometrics.

Due to the foregoing, the company will not request sensitive data from natural persons, Holders, unless it is essential for the adequate provision of its services or the maintenance of a labor or contractual relationship. Now, if the Holder considers that it is necessary to provide this type of data, it will be requested that they be sent together with the due authorization, and thus be able to allow its Treatment for the legitimate purposes of the business and the purposes established by this Policy.

By virtue of Decree 1074 of 2015, all holders are informed that because it is sensitive data, they are not obliged to authorize their treatment.

1. In the case of sensitive personal data, they may be used and processed when:

• The Holder has given his explicit authorization to said treatment, except in cases where by law the granting of said authorization is not required.
• The Treatment is necessary to safeguard the vital interest of the owner and he is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.
• The Treatment is carried out in the course of legitimate activities and with due guarantees by a foundation, ONG, association or any other non-profit organization, whose purpose is political, philosophical, religious or union, provided that they refer exclusively to its members or to people who maintain regular contact by reason of its purpose. In these events, the data may not be provided to third parties without the authorization of the owner.
• The Treatment refers to data that are necessary for the recognition, exercise or defense of a right in a judicial process.
• The Treatment has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Holders must be adopted.

• Exceptions to the Prior and Express Authorization of the Holder.

Notwithstanding the foregoing, and in accordance with the Law, the company may proceed to the Processing of your data, without requiring your prior authorization, when it concerns:

• Information required by a Public or Administrative Entity in the exercise of its legal functions or by court order;
• Data of a public nature (in accordance with the legal definition of the term);
• Cases of medical or health emergency;
• Treatment of information authorized by Law for historical, statistical or scientific purposes;
• Data related to the Civil Registry of Persons.

Except for the aforementioned exceptions, and within the legitimate purposes of the company's corporate purpose, in no case will they be supplied, distributed, commercialized, shared, exchanged with third parties and, in general, will carry out any activity in which the confidentiality and protection of the information collected.

However, the data that is collected by the company may, eventually, be shared with other members of the company and with third parties, for purposes of complying with the purposes of the companies and in such cases, they will share the policy and / or the third parties will maintain

a data transmission contract. In the event that such information is going to be shared with Third Parties other than other members of the Company; with Third Parties who are not Clients of the Company or who do not have a direct interest in the information provided, a policy must be in place or this policy will be adopted either in the case of assignment, transfer and transmission of personal data.

8. DATA PROCESSING OF CHILDREN, GIRLS AND ADOLESCENTS

The Processing of Personal Data of children and adolescents is prohibited, except in the case of data of a public nature, and when such processing meets the following parameters and / or requirements:

• That they respond to and respect the best interests of children and adolescents.
• That the respect of their fundamental rights is ensured.

Once the above requirements have been fulfilled, the legal representative of the children or adolescents will grant the authorization, after the minor's exercise of their right to be heard, an opinion that will be valued taking into account the maturity, autonomy and ability to understand the matter.

9. LAWS OF THE HOLDERS

• Know, update and rectify your Personal Data in front of GONZALEZ LAWYERS GROUP S.A.S. or those in charge of the treatment thereof. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading Personal Data, or those whose Treatment is expressly prohibited or has not been authorized.

• Request proof of the Authorization granted to GONZALEZ LAWYERS GROUP S.A.S., unless the Law indicates that said Authorization is not necessary.

• Submit applications to GONZALEZ LAWYERS GROUP S.A.S. or the Person in Charge of Treatment regarding the use that has been given to your Personal Data, and that they provide you with such information.

• Present before the Superintendence of Industry and Commerce complaints for infractions of the Law.

• Revoke your Authorization and / or request the deletion of your Personal Data from the GONZALEZ LAWYERS GROUP SAS Databases, at any time, or when the Superintendency of Industry and Commerce has determined through a definitive administrative act that GONZALEZ LAWYERS GROUP SAS or the Person in Charge of the Treatment has incurred in conduct contrary to the Law.

• Access free of charge, at least once a month, to your personal data that have been subject to Treatment.

Access free of charge, at least once a month, to your personal data that have been subject to Treatment.

10. PROCEDURE TO KNOW, UPDATE, RECTIFY, DELETE INFORMATION OR REVOKE THE AUTHORIZATION

For GONZALEZ LAWYERS GROUP S.A.S. It is vital to protect and maintain the confidentiality of the Personal Data of the Holders. The Company determines that the procedure to know, update, rectify, delete information or revoke the authorization for the Treatment of Personal Data, implies the duty of the Holder to contact GONZALEZ LAWYERS GROUP S.A.S. through the means provided for it, namely:

• Making a telephone request through the customer service lines arranged for it in accordance with the provisions of this Policy;
• Sending a scanned written request to the email provided by the Company, which must be accompanied by a copy of the Holder's identity document or,
• Sending a written request to the Company's registered office, which must be accompanied by a copy of the Holder's identity document.
• The Personal Data Holders may at any time request GONZALEZ LAWYERS GROUP S.A.S. the deletion of your data and / or revoke the authorization, by submitting a claim in accordance with the provisions of article 15 of Law 1581 of 2012.

It is essential to note that the request to suppress the information and revoke the authorization will not proceed when the Holder has a legal or contractual duty with GONZALEZ LAWYERS GROUP S.A.S.

In accordance with art. 20 of Decree 1377 of 2013, the exercise of the aforementioned Rights may be exercised by:

• By the Holder, who must sufficiently prove his identity by the different means made available to him by the person in charge.
• By their successors, who must prove such quality.
• By the representative and / or attorney-in-fact of the Holder, prior accreditation of the representation or power of attorney.
• By stipulation in favor of another or for another.
• The rights of children or adolescents will be exercised by the people who are empowered to represent them.

1. AUTHORIZATIONS

The Processing of Personal Data carried out by GONZALEZ LAWYERS GROUP S.A.S. requires the free, prior, express and informed consent of the Holder of said data. GONZALEZ LAWYERS GROUP S.A.S. In its capacity as Responsible for the Processing of Personal Data, it has had the necessary mechanisms to obtain the authorization of the holders, guaranteeing in all cases that it is possible to verify the granting of said authorization.

In the case of the website, the authorization is understood to be granted in favor of GONZALEZ LAWYERS GROUP S.A.S. from the first use of the website. In any case, the authorization must be given by the Holder and it must be possible to verify that he knows and accepts that GONZALEZ LAWYERS GROUP S.A.S. will collect and use the information for the purposes that are disclosed to it for the purpose prior to the granting of authorization.

By virtue of the foregoing, the requested authorization must include:

• Responsible for the Treatment and what data is collected;
• The purpose of the data processing;
• The rights of access, correction, updating or deletion of the personal data provided by the owner and,
• Sensitive Data is collected.
• Additionally, the Holder will be informed (i) that he is not obliged to authorize the treatment, and (ii) that it is optional to provide this type of information.

• INQUIRIES

The owners, their duly authorized representatives or successors may consult the personal information of the Owner that resides in any database. Consequently, by GONZALEZ LAWYERS GROUP S.A.S. guarantees the right of consultation, providing the holders with all the information contained in the individual record or that is linked to the identification of the Holder. Regarding the attention of requests for consultation of personal data by GONZALEZ LAWYERS GROUP S.A.S. guarantees:

Use the customer service you have in operation. In any case, regardless of the mechanism implemented to attend to consultation requests, they will be attended to within a maximum term of (20) twenty business days from the date of receipt.

When it is not possible to attend the query within said term, the interested party will be informed stating the reasons for the delay and indicating the date on which the query will be attended, which in no case may exceed ten (10) business days following the expiration of the first installment

• CLAIMS

The owners, duly authorized representatives or successors who consider that the information contained in a database should be subject to correction, updating, or deletion, or when they notice the alleged breach of any of the duties contained in the Law, may submit a Claim before the Data Controller, channeling it and sending it through the designated agency that will exercise the function of protection of personal data within GONZALEZ LAWYERS GROUP SAS

The claim may be submitted by the Holder, taking into account the information indicated in article 15 of Law 1581 of 2012 and in decree 1074 of 2015, and other regulations that modify or add them.

In the event that GONZALEZ LAWYERS GROUP S.A.S. is not competent to resolve the claim presented to it, it will transfer to the corresponding person within a maximum term of five (5) business days and will inform the interested party of the situation.

If the claim is incomplete, the interested party or the representative will be requested to complete the missing information within a period of five (5) days. If two (2) months elapse without the request being completed, it is understood that the request you were making has been withdrawn.

Once the claim is received, within two (2) business days following receipt of the request, GONZALEZ LAWYERS GROUP S.A.S. It will include in the Database a legend that says "Claim in process" and the reasons for it. Said legend will be kept until the claim is decided.

The maximum term to attend the claim will be fifteen (15) business days from the receipt of the request in accordance with article 15 of Law 1581 of 2012. If it is not possible to respond in the indicated time, by GONZALEZ LAWYERS GROUP SAS will inform the interested party specifying the reasons and the date on which a response will be given, which in no case may exceed eight (8) business days following the expiration of the first term.

11. ATTENTION TO REQUESTS, CONSULTATIONS AND CLAIMS

The owner or his successors in title interested in submitting their query, request or claim can use any of the following communication channels:

• For requests for CONSULTATION of personal data, you can contact the customer service lines enabled in Barranquilla Telephone 3008010300, and by means of a written address of the company Carrera 64b No. 84-105, as well as by e-mail; asesorias@gonzalezlawyersgroup.com and our website: http://www.gonzalezlawyersgroup.com
• The owner who considers that the information contained in the GONZALEZ LAWYERS GROUP S.A.S. It must be subject to CORRECTION, UPDATE, DELETE or when they notice the alleged breach of any of the duties contained in Law 1581 of 2012, you can send a request by means of a written filing at the address detailed above, which must contain:
• Name of the Holder and / or his representative and / or Assignees;
• Copy of the identity document of the Holder and / or his representative and / or Assignees;
• Description of the facts that give rise to the claim;
• Physical and electronic address and contact telephone number of the Holder and / or his representative and / or his successors in title;
• Documents that you want to enforce.
• Signature and identification number.

12. INFORMATION AND MECHANISMS PROVIDED BY GONZALEZ LAWYERS GROUP S.A.S. AS RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

• Company name: GONZALEZ LAWYERS GROUP S.A.S.
• NIT: 900406324 – 1
• Address: Barranquilla -Atlántico
• Address: Carrera 64b No. 84- 105
• Phones: 3008010300
• Email: asesorias@gonzalezlawyersgroup.com

13. AREA RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

The Management Area of GONZALEZ LAWYERS GROUP S.A.S. It will be the area in charge of receiving requests, complaints or claims from the Holders of Personal Data.

This area is responsible for carrying out the necessary internal management in order to guarantee a clear, efficient and timely response to the Data Holder.

14. DUTIES OF THE RESPONSIBLE FOR DATA PROCESSING

GONZALEZ LAWYERS GROUP S.A.S. As Responsible (who by itself or in association with others, decides on the database and / or data processing), it will comply with the following duties:

• Guarantee the Holder, at all times, the full and effective exercise of the right to habeas data.
• Request and keep a copy of the respective authorization granted by the owner.
• Duly inform the owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
• Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
• Guarantee that the information that is provided to the person in charge of the treatment is truthful, complete, exact, updated, verifiable and understandable.
• Update the information, communicating in a timely manner to the person in charge of the treatment, all the news regarding the data that you have previously provided and adopt the other necessary measures so that the information provided to it is kept updated.
• Rectify the information when it is incorrect and communicate the pertinent to the person in charge of the treatment.
• Provide the Treatment Manager, as the case may be, only data whose Treatment is previously authorized.
• Require the Treatment Manager, at all times, to respect the security and privacy conditions of the Owner's information.
• Process the inquiries and claims made.
• Inform the Treatment Manager when certain information is under discussion by the Holder, once the claim has been submitted and the respective procedure has not been completed.
• Inform at the request of the Owner about the use given to their data.
• Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the Holders.
• Use only data whose treatment is previously authorized in accordance with the provisions of Law 1581 of 2012.

GONZALEZ LAWYERS GROUP SAS, will keep in mind, at all times, that personal data are the property of the people to whom they refer and that only they can decide on them. In this sense, it will use them only for those purposes for which it is duly empowered, and in all cases respecting current regulations on the protection of personal data.

15. DUTIES OF GONZALEZ LAWYERS GROUP S.A.S. WHEN YOU ACT AS A MANAGER

In the event in which GONZALEZ LAWYERS GROUP S.A.S. Act as MANAGER when carrying out any treatment on behalf of and on behalf of a person in charge, will comply with the duties established in Law 1581 of 2012, regulatory standards, applicable jurisprudence, in any case it will guarantee the protection of the fundamental right to protect personal data of the headlines.

16. SECURITY MEASURES

The company declares that it has a technological infrastructure that reasonably protects the personal information collected, limiting access to third parties as far as possible. However, The Company will make continuous efforts to improve the security standards that protect the personal information collected.

However, the company is exonerated of responsibility for illicit manipulations of third parties, technical or technological failures, which are beyond its control as well as any situation that is not attributable to it.

17. INTERNATIONAL TRANSFER OF PERSONAL DATA

In the event that data is sent or transferred to another country, the authorization of the owner of the information that is being transferred must always be obtained. Unless the law says otherwise, the existence of said authorization is necessary to carry out the international circulation of data. In this sense, before sending personal data to another country, those obliged to comply with this policy must verify that they have the prior, express and unequivocal authorization of the owner that allows them to transmit their personal data.

Said transfer of personal data is carried out only to third parties with whom GONZALEZ LAWYERS GROUP SAS has a contractual, commercial and / or legal link. In general, the transfer of personal data to third countries will be governed by the following conditions:

• The transfer of personal data to third countries will only be carried out when there is a corresponding authorization from the owner and prior authorization from the SIC's Personal Data Delegation.
• An international transfer is considered any treatment that involves a transmission of data outside of Colombian territory, whether a transfer of data is made, or if it was intended to provide a service to the person in charge outside of Colombia.
• Prior authorization must be obtained from the Personal Data Protection Delegate of the Superintendency of Industry and Commerce, when international data transfers are planned to countries that do not provide a certain level of protection. This authorization may only be granted if adequate guarantees are obtained, such as contracts based on the standard clauses approved by the SIC, or the Binding Corporate Rules.
• The international transfer of data may be carried out at the request of GONZALEZ LAWYERS GROUP SAS, establishing the purpose, the groups of interested parties or holders of the personal information, the data subject to transfer and the documentation that incorporates the guarantees required to obtain the authorization; in which a description of the specific security measures that will be adopted, both GONZALEZ LAWYERS GROUP S.A.S. as the person in charge or by the person in charge of the data in their place of destination.

18. TRANSMISSION OF INFORMATION

In accordance with the provisions of Decree 1074 2015 and in response to the internal policies and procedures of the company, the national and international transmission of personal data may be carried out. The company, as the person responsible for the processing of personal data, will issue instructions on the scope of the activities that the Person in Charge will carry out on behalf of the company for the processing of personal data. In the same way, the treatment carried out by the Manager will comply with the provisions of this Privacy Policy. The person in charge of the treatment of personal data will be in charge of safeguarding the databases and in the same way, keeping the confidentiality of the same.

19. SANCTIONS

Failure to comply with this policy may generate sanctions or consequences for the different parties that do not comply with what is established herein, in accordance with what is determined by the Compliance Officer.

20. MODIFICATION OF THE POLICY

GONZALEZ LAWYERS GROUP S.A.S. reserves the right to modify, at any time, unilaterally, this "Personal Data Processing Policy". The changes made will be published and will not take effect until after they are published. The continuous use of the services or non-disconnection of the same by the owner of the data after the notification of the changes made to the "Personal Data Treatment Policy" constitute their acceptance.

In any case, the changes made to this "Personal Data Treatment Policy" will be made in strict compliance with and respect for the provisions of Colombian regulations that regulate the matter. For this reason, it is invited to periodically review this Policy, in order to stay informed regarding the protection mechanisms implemented by the company for the protection of personal information.

21. COOKIES

When you enter the Company's website, our server adds a small text file ("cookie") to your computer's hard drive. This "cookie" is unique for each User and simply indicates whether they have already been to our site. It is important to note that "cookies" are safe, since they cannot be executed as programs and cannot be used to send any type of virus.

Our "cookies" are used to:

• Identify each computer.
• Prepare anonymous statistics on the habits of use of the web, by our visitors.

The confidential information provided will not be collected or used for purposes other than those established in this Privacy Policy or those permitted by law.

It is appropriate to clarify that some browsers have settings to accept "cookies". The User is completely free to configure the browser to reject them, although, if the "cookies" are disabled, it may happen that some features of the services do not perform adequately.

22. VALIDITY

The policy applies as of April 7, 2020 and will be available to the holders through the website: www.gonzalezlawyersgroup.com

As a general rule, the term of authorizations on the use of personal data is understood as the term of the commercial relationship or of the relationship with the company and during the exercise of the company's corporate purpose or during the period in which the purpose for which they were collected remains, plus the term established by law

The authorizations of the holders may terminate at their will at any time. If the person is an active client of by GONZALEZ LAWYERS GROUP S.A.S. Your data may not be used for a purpose other than the provision of the product or service and for the offer of subsequent renewals when the service has this modality.

When the terms of the privacy policies of any of the services or products contracted by an owner change in essentials, as a general rule, in the services that have the option of renewal, the new authorization will be obtained. For all other cases, authorization will be obtained in the manner established for each privacy policy or notice or through the usual means of contact between the company and the owners.

Any substantial change in the Treatment policies will be communicated in a timely manner to the owners of the data through the website www.gonzalezlawyersgroup.com

For holders who do not have access to electronic media or those who cannot be contacted, it will be communicated through open notices on the website or at the company headquarters.

Communications will be sent at least five (5) days before implementing the new policies and / or substantial update thereof.