CENATI'S PRIVACY AND PERSONAL DATA PROTECTION POLICY  

Below we will find the Privacy and Personal Data Protection Policy (hereinafter the Privacy Policy) applicable to people who supply their personal data (hereinafter the "Registered Headline" or "You") to CENATI in our databases, Privacy Policy that defines the uses and treatment given to Personal Information (as defined below) that Registered Headlines provide to us.

Responsible and in charge for Treatment

Responsible for the processing of the data of the Headlines will be the "CENATI" located in the city of Bogotá D.C., identified with NIT. No. 900463260-1, who will be able to store the data, generate databases, use, exploit, market and transfer them as established in this Privacy Policy.

The controllers shall be all third parties to whom Cenati transmits the data of the Headlines who shall be bound by this Privacy Policy and who shall perform the Treatment as strictly permitted by Cenati, with the consent of the Headlines.

Scope of the Privacy Policy:

This Privacy Policy shall apply to all databases and/or files containing Personal Data that are the subject of Treatment by Us, in events in which we are considered responsible and/or responsible for the processing of Personal Data of natural persons, in accordance with the provisions of the Statute Law 1581 of 2012, Decree 1377 of 2012 13 and other rules amending and/or adding them thereafter

Definitions:

For the purposes of this Policy, the following terms shall be understood as defined in Article 3 of Law 1581 of 2012, as transcribed below:

• Personal Data: Any information linked to or that may be associated with one or more particular or determinable natural persons (hereinafter "Personal Data" or "Personal Information").
• Database: Any organized set of Personal Data that is the subject of Treatment.
• Treatment: Any operation or set of operations on Personal Data, such as its collection, storage, use, circulation, or deletion.
• Treatment Manager: A natural or legal person, public or private, who, by himself or in association with others, performs the Treatment of Personal Data on behalf of the person responsible for the treatment.
• Responsible for Treatment: A natural or legal person, public or private, who alone or in association with others, decides on the Database and/or Data Treatment.
• Headline: Natural person whose Personal Data is processed.
• Data Transmission: Processing of Personal Data which involves the communication of such data within or outside the territory of the Republic of Colombia when it has the purpose of carrying out a Processing by the Data Controller on behalf of the Data Responsible.
• Data Transfer: The transfer of data takes place when the Responsible and/or Controller from Processing personal data, located in Colombia, sends the information or personal data to a recipient, who in turn is responsible for the processing and is inside or outside the country.
• Sensitive Data: Sensitive data means data that affects the privacy of the headline or whose misuse may affect the privacy of the holder or the potential to generate discrimination against him.
• Public Data: Data that is not semi-private, private, or sensitive. Public data are considered, among others, data relating to the marital status of persons, their profession or trade and their status as a trader or public servant.

Cenati's treatment of personal data:

Cenati, in the development of its social object and economic activity, acts as Responsible for the Processing of Personal Data in its databases. Consequently, it collects, stores, uses, transmits, transfers, and suppresses personal data of natural persons with whom it has or has had any kind of relationship, whatever its nature (civil, commercial and/or labor); including but not limited to customers, consumers, suppliers, contractors, workers, creditors, debtors, and shareholders through different means such as physical or virtual means (hereinafter "Personal Information").

Using the Privacy Policy and Protecting Your Information

Aiming to offer a more personalized experience to our users, Cenati collects your Personal Information at the time of registration in median formats, through systems and/or Web Pages or through any other means at our points of care; Registration that gives you the status of Registered Owner. By registering your data on our system, You agree that you know that you are subject to this Privacy Policy by expressly authorizing the use of your Personal Information for the purposes indicated herein and in the manner indicated herein. You therefore expressly acknowledge that if you do not agree with this Privacy Policy and want to reserve or limit any of the uses of the information, you will not be able to register in our Databases or provide us with information through our formats, systems and/or web pages.

We are committed to the security and proper use of your information and therefore, we use it properly, aiming to maintain the confidentiality of it, in accordance with this Privacy Policy. Personal Information may be transferred to third parties and to judicial or administrative authorities, whether natural or legal persons, Colombians, or foreigners, at events where the transfer or transmission of data is necessary to carry out the uses and activities authorized by the Holders under the social object of Cenati or related activities. At all events, such information shall be kept under strict confidentiality and subject to a Strict Treatment, respecting the rights and guarantees of its Headlines.

Cenati may transfer the Headlines’s Personal Data as part of the Cenati's assets to third party business allies for the purpose of third parties processing it under the same terms and conditions established in this Privacy Policy.

Specifically, but not limited to, we will be able to use service providers and data processors working on behalf of Cenati. Such services may include system hosting and maintenance services, analysis services, e-mail messaging services, delivery services, payment transaction management, and solvency and address controls, among others. As a result, as Licensee, you must understand that by supplying information to CENATI you will automatically be granting these third parties’ permission to access your Personal Information.

It is important to clarify that Cenati has taken and will take all necessary actions to ensure that service providers and processors working on behalf of the company, as well as parents, subsidiaries, and subordinates and other third parties authorized under this Privacy Policy, protect, at all events, the confidentiality of the Personal Information in their charge.

The Headline shall, in any event, respond to the truth of the data provided, and Cenati reserves the right to exclude from the registered services any Licensee who has provided false information. Cenati will be able to collect information in the public domain to supplement the databases. Such information shall be treated in the same manner as described in this Privacy Policy.

Authorisation Effects

For all purposes, it is understood that the express and informed authorization that You grant to us for the treatment of your personal data, whatever has been your means our website, mail implies the full understanding and acceptance of all content of this Privacy Policy.

Collected Information

The information that we may collect when we register with our databases (the Personal Information) includes, but is not limited to, the following:

• Full name
• Government ID
• Date of birth
• Nationality
• Gender
• Civil status
• Contact address
• Neighbourhood
• Telephone number
• E-mail address
• Professional information
• Financial reporting

Activities that the Headline performs within our website through the use of Cookies, such as user’s URL information, which URLs it then accesses, which browser it is using, in order to understand the behavioral interests and demographics of the Headline.

Use of information

Below, we determine the uses that We will give to your Personal Information, which you expressly authorize by registering in our Databases and providing us with your Personal Information. Personal Information collection allows us to generate better benefits for our users.

• Contact You if you create any problem or inconvenience with your registration.
• Contact You to offer you new products and/or services, show advertising or promotions of interest offered by Us, and in general to develop Our social object.
• Sending e-mails confirming your registration or as part of a news in each e-mail sent there is the possibility to request not to be registered in this list of e-mails to stop receiving them. To do this, you will need to reply to the email requesting that no information be sent back to you through that medium.
• Send you information about products and/or services based on the information we obtain.
• Make marketing communications, promotions, and direct marketing campaigns by any means virtual or physical. If you prefer, you may ask to be excluded from the lists for the sending of promotional or advertising information.
• Internal studies to understand profiles, interests, behavior, demographics, segmentations in order to understand their needs, interests and provide better benefits and services based on the information provided.
• Use of Personal Information by Us and/or outsourced third parties for this purpose, on occasion and for the development of our social object.
• Conduct internal studies to understand profiles, interests, behavior, demographics, segmentations in order to understand the needs of the Headline, his interests and, consequently, to provide better benefits and services based on the information provided.
• To treat information in physical and digital media, ensuring the correct registration and use of Cenati's websites, our marketing campaigns, special activities and loyalty programs.

Rights of Personal Information Headlines

You, as the headline of the Personal Information you provide us, will have the following rights:

• The right to know, update and correct your personal data against Cenati or the other companies in charge of the processing of your personal data, as indicated in this Policy. This right may be exercised, inter alia, against partial, inaccurate, incomplete, broken-down data which mislead, or data whose processing is expressly prohibited or not authorized.
• The right to request proof of the authorization granted to Cenati, except where expressly exempted in law as a requirement for treatment.
• The right to request information about the use you have given to your Personal Information.
• The right to be informed by CENATI or one of the companies in charge of the processing of personal data, upon request, about the existence of data concerning you and the use given to your personal data.
• The right to revoke the authorization and to request the deletion of the data when no use is made in accordance with the authorized procedures.
• The right to make inquiries and grievances about Personal Information. Your inquiries or complaints will be handled within ten (10) business days. If it is not possible to resolve your inquiry or grievance within this term, You will be informed of this situation and the term of reply may be extended for up to five (5) additional business days. The response to the inquiries or complaints you make may be delivered by any physical or electronic means
• The right to complain to the Superintendencia de Industria y Comercio for violations of the provisions of Law 1581 of 2012 and other regulations that amend, add, or supplement it.
• The right to free access to your personal data which has been processed.

Personal Information Confidentiality

The Personal Information provided by You will be used by Us, our associates and third parties authorised for such purposes in the forms set forth in both the authorisation and these Privacy Policies and will not be for any purpose other than those for which it was provided, and we will endeavour to protect the privacy of the Personal Information. We will retain your information under security conditions necessary to prevent your tampering, loss, consultation, unauthorised or fraudulent use or access, and respect for the rights of its headlines.

If under any circumstances a competent authority requests the Personal Information to be disclosed, we will give you notice of such order in advance.

Confidentiality of Confidential and Privileged Information shall be of an unlimited duration, that means, the obligation persists over time.

Under Age

Pursuant to Article 7 of Law 1581 of 2012 and Article 12 of Decree 1377 of 2013, Andean will proceed to the processing of personal information, of children and adolescents, respecting their best interests and ensuring, in all cases, respect for their fundamental rights and guarantees. In all events where the Personal Information of minors is required to be treated, Cenati shall obtain the appropriate authorization from the legal representative or guardian of the child or adolescent; after exercising the child's right to be heard, an opinion that will be valued considering the child's maturity, autonomy and ability to understand the content of the authorization and the processing of his/her Personal Data.

We inform you in advance that by granting us your authorization to process your data by CENATI, you are also authorizing us to use and treat your children's personal data in case you have not provided it.

Such treatment shall be carried out in accordance with the uses and purposes described in this Privacy Policy and shall, in particular, authorize the sending of emails to legal representatives/parents/guardians/guardians/guardians of minors with information content regarding activities, promotions, offers and invitations according to the age of minors, as well as to include them in our demographic studies and loyalty programs.

Enquiry, Rectification, and Claims Procedure:

The rights to know, update, rectify, delete and revoke the authorisation, or request proof of the authorization, may be exercised by a written request addressed to the Marketing area, commissioned by Cenati to address these requests, at Carrera 51 No. 66º - 51 Int 10 in Bogotá D.C. - Colombia, or by sending an e-mail to contacto@cenati.com.co.  contacto@cenati.com.co

As a prerequisite to process any enquiry or claim, the identity of the claimant, who must be the Information Holder, its representative, or one of its holders, will be verified.

Any query or complaint shall contain at least:

1. Identification of the Headline and the Claimant (if not the Headline itself).
2. Description of the facts that give rise to the claim or Inquiry.
3. Physical or electronic notification address; and
4. Petition or subject of complaint.

Query: Queries and requests from the Headlines shall be met within a maximum of ten (10) working days, counted from the date of receipt of these requests, if they meet the minimum requirements mentioned above. In the event that it is not possible to resolve the consultation within this term, the Holder shall be informed of this situation at the notification address that he has included in the respective consultation, and the reply term may be extended for up to five (5) additional working days. Responses to queries or claims submitted by the Holders may be submitted by any physical or electronic means.

Rectifications and Claims: When the Headline’s information or its representative or its originators consider that their information must be corrected, updated, or deleted, or when they notice an alleged failure by Cenati to comply with its duties in the field of Personal Data Protection contained in the applicable law and this Privacy Policy, they may file a complaint as follows:

• A written application must be submitted in response to the specific request.
• If the claim is incomplete, Cenati will require the person concerned within five (5) days of receipt of the request to complete and remedy the request:

1. If two (2) months elapse from the date of the request without the applicant having given a reply, the claim shall be deemed to have been withdrawn.
2. If the person who receives the claim is not competent to resolve the claim, he or she shall transfer the claim to the person who is competent to resolve the claim within a maximum of two (2) business days and inform the applicant accordingly.

• If the claim is received in full or completed subsequently, a "legend" in the database indicating "CLAIM IN TRAMIT" must be included within two (2) business days.
• Cenati will resolve the claim within fifteen (15) business days from the day following receipt of the claim. In case that it is not possible to resolve the inquiry within this term, the Headline shall be informed of the delay, the reasons, and the date of reply at the notification address you have included in the respective claim. In any event, the reply term may not exceed eight (8) business days following the expiry of the first term. Responses to claims submitted by the Headlines may be made by any physical or electronic means.

Data Delete Request

When data deletion is requested, it cannot be performed in the following cases: (i) where it is a legal obligation to keep them; (ii) where the Headline has contractually obliged to permit its use; (iii) where the data are retained in order to safeguard the interests of the Headline or the Public Interest; (iv) when the removal makes it difficult or hindering the exercise of the functions of the administrative or judicial authorities.

Authorization Revocation

Where a Headline wishes to revoke the authorization, it has given for the use of its personal data, it shall inform the Treatment Responsible clearly, whether the revocation is full or partial. Revocation of authorization is partial when the holder of the information claims that he wishes to revoke his authorization for the Treatment of his personal data for certain specific purposes, such as sending advertising information, communications, news, and so on. The revocation of the authorization shall be complete when the information holder requests that the Personal Data Treatment be terminated completely for all authorized purposes.

Contact us

In the event of any doubt or concern about this Privacy Policy or the treatment and use of your personal information please direct your queries to the email contacto@cenat.com.co PBX +571-742 45 06 / 305 205 7366 contacto@cenat.com.co PBX +571-742 45 06 / 305 205 7366

Changes to Privacy Policies

We are fully empowered to amend these Privacy Policies. Any changes will be duly published on our website www.cenati.com.co and will be further notified to them either by electronic or physical means. The granting of the authorization, as well as the registration on the Website and its continuity in the use of it will be understood as an express manifestation of the acceptance of these Privacy Policies. www.cenati.com.co/ y adicionalmente les será notificado ya sea por medios electrónicos o físicos. El otorgamiento de la autorización, así como el registro en la Página Web y su continuidad en el uso de la misma será entendido como manifestación expresa de la aceptación a estas Políticas de Privacidad.