El Poblado SAData processing policy.

INTRODUCTION

The Political Constitution of Colombia, in its article 15 establishes that "All people have the right to their personal and family privacy and to their good name, and the State must respect them and enforce them", in accordance with Statutory Law 1581 of 2012, which indicates the rights that people have to know, update and rectify the information that has been collected about each of them in databases and in the files of public entities or private companies.

Law 1581 of 2012 stipulated that the provisions contained in this standard will be applicable to all entities of a public or private nature that carry out any treatment of personal data registered in their databases.

EL POBLADO SA is a commercial company that, due to its corporate purpose, processes personal data, which is why it complies with the provisions of the national regulatory framework regarding the protection of personal data, adopting this Personal Data Processing Policy, that seeks to protect and guarantee the rights of owners of personal data who have provided information to the company, prior authorization for said treatment; This policy is mandatory for all natural or legal persons who process personal data from the company's databases.

1 REACH

This policy applies to all personal data processed in the databases of EL POBLADO SA, as managers, and their managers, in compliance with the provisions of Law 1581 of 2012, Decrees 1377 of 2013 and 1074 of 2015, as well as the other norms that complement or regulate them.

In this sense, the guidelines and directives contained in this policy must be observed and respected, with which the regulation on the protection of personal data in EL POBLADO SA is established.

2. OBJECTIVE

Establish the guidelines to guarantee the protection of personal data that are subject to treatment by EL POBLADO SA and its managers, in development of its corporate purpose, to comply with the law, policies and procedures established by EL POBLADO SA for the protection of personal data. rights of the holders.   

3. DEFINITIONS

The following words shall have the meanings indicated:

• NOTICE OF PRIVACY: Verbal or written communication generated by the person in charge, addressed to the owner for the processing of their personal data, through which they are informed about the existence of the information processing policies that will be applicable to them, the way to access them and the purposes of the treatment that is intended to be given to personal data.
• AUTHORIZATION: Prior, express and informed consent of the owner to carry out the processing of personal data.
• DATABASE: Organized set of personal data that is subject to treatment, including physical and electronic files.
• CONFIDENTIALITY: Information security element that allows establishing who can access it and under what circumstances.
• PERSONAL DATA: Any information linked or that can be associated with one or several determined or determinable natural persons.
• PRIVATE DATA: It is the data that due to its intimate or reserved nature is only relevant to the owner.
• PUBLIC DATA: It is the data that is not semi-private, private or sensitive. Public data is considered, among others, the data related to the marital status of people, their profession or trade and their quality as merchant or public servant. Due to its nature, public data may be contained, among others, in public registries, public documents, gazettes and official bulletins and duly enforced judicial sentences that are not subject to reservation.
• SENSITIVE DATA: It is a special category of Personal Data that is specially protected, because it is those that affect the privacy of the owner or whose improper use can generate discrimination. They are, among others, those concerning health, sex, political orientation, race or ethnic origin, union membership, biometric fingerprints, etc.
• SEMI-PRIVATE DATA: It is the data that is not of an intimate, reserved, or public nature and whose knowledge or disclosure may be of interest not only to its owner but also to a certain sector or group of people.
• RIGHT OF CHILDREN, GIRLS AND ADOLESCENTS: In the treatment, respect for the prevailing rights of children and adolescents will be ensured.
• PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA: They are the fundamental rules, of a legal and/or jurisprudential nature, that inspire and guide the processing of personal data, based on which actions and criteria are determined to solve the possible collision between the right to privacy, habeas data and protection of personal data, and the right to information
• RESPONSIBLE: Natural or legal person, public or private, that by itself or in association with others, decides on the database and/or the Treatment of the data.
• HEADLINE: Natural person whose personal data is subject to Treatment.
• TRANSFER: It takes place when the person in charge and/or in charge of the Processing of Personal Data, located in Colombia, sends the information or personal data to a recipient, who in turn is Responsible for the Treatment and is located inside or outside the country.
• TRANSMISSION: Treatment of Personal Data that implies the communication of these inside or outside the territory of the Republic of Colombia when its purpose is to carry out a Treatment by the Manager on behalf of the person in charge.
• TREATMENT: Any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion.
• USER: It is the natural or legal person who has an interest in the use of personal information.
• VIOLATIONS OF THE SECURITY MEASURES OF PERSONAL DATA: A security incident will be considered a situation that implies a violation of the security measures adopted by EL POBLADO SA to protect the personal data delivered for its custody, either as the person in charge and/or in charge, as well as any other conduct that constitutes an inappropriate treatment of personal data contrary to what is provided herein or what is indicated in the Law. Any security incident that compromises the personal data held by EL POBLADO SA must be reported to the control authority on the matter.

4. RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA

EL POBLADO SA is the legal person responsible for the treatment of the information contained in its databases. All the information of the person in charge is detailed below:

• Company name: EL POBLADO SA
• : 802.018.014-1
• Address: Barranquilla, Atlántico
• Address: Carrera 49 No. 75- 83
• Email: servicioalcliente@elpobladosa.com
• Telephone: +57 60 (5) 385 2827
• Web page: elpobladosa.com

5. RECIPIENTS

This policy will apply to:

1. Board of Directors of EL POBLADO SA
2. Legal representative of EL POBLADO SA
3. Shareholders of EL POBLADO SA
4. Tax auditor of EL POBLADO SA
5. Employees of EL POBLADO SA, including the management part that guards and processes personal data.
6. Clients of EL POBLADO SA, in those events in which the relationship is established with a natural person; likewise in the case of legal persons, when the officials designated by them provide data of this nature for the development of the established contract.
7. Suppliers and contractors who, by virtue of the constituted civil or commercial relationship, provide personal data.
8. Treatment managers.
9. Citizens in general, so that they have at their disposal the necessary and sufficient information about the different treatments and purposes for which their data will be subject, as well as the rights that they, as holders of personal data, can exercise against EL POBLADO SA, as responsible for the processing of your personal data.

6. APPLICABLE PRINCIPLES

EL POBLADO SA will harmoniously and comprehensively apply the following principles in all processes and/or activities related to the processing of personal data, which are aligned with those established in article 4 of Law 1581 of 2012:  

1. Principle of freedom or Consent: Data processing within EL POBLADO SA can only be done with the prior, express and informed consent of the owner. Personal data may not be obtained, processed or disclosed without the owner's authorization except by legal or judicial mandate that replaces the owner's consent.
2. Principle of legality: The processing of personal data is a regulated activity and therefore the business processes and recipients of this standard must be subject to the provisions of this standard.
3. Principle of purpose: The processing of personal data must obey a legitimate purpose, in accordance with the Constitution and the law, which must be informed in a concrete, precise and prior manner to the owner so that he can express his informed consent.
4. Principle of veracity or data quality: The personal data collected by EL POBLADO SA must be true, complete, exact, verifiable, understandable and kept up to date. The processing of partial, fractional, incomplete or misleading data is prohibited.
5. Principle of transparency: In the processing of personal data, the right of the owner to obtain and know from the person in charge and/or in charge of the treatment, at any time and without restrictions, information about the existence of data that concerns him, will be guaranteed.
6. Principle of relevance of the data: In the collection of personal data by EL POBLADO SA, the purpose of the treatment and/or the database must be taken into account; therefore, they must be adequate, relevant data and not excessive or disproportionate in relation to the purpose. The collection of disproportionate personal data in relation to the purpose for which it is obtained is prohibited.
7. Principle of access or restricted circulation: The personal data collected or processed by EL POBLADO SA will be used by it, only within the scope of the purpose and authorization granted by the owner of the personal data, therefore, they may not be accessed, transferred, assigned or communicated to unauthorized third parties. The personal data in the custody of EL POBLADO SA may not be available on the Internet or in any other means of mass disclosure, unless access is technically controllable and secure, and to provide restricted knowledge only to the owners or authorized third parties in accordance with the provided in the law and the principles that govern the matter.
8. Principle of temporality of the data: Once the purpose for which the personal data was collected and/or processed has been exhausted, EL POBLADO SA must cease its use and therefore adopt the pertinent security measures for this purpose. To this end, the obligations of commercial law regarding the conservation of trade books and correspondence of the merchant, and the other labor, civil and administrative regulations on the subject will be taken into account.
9. Data security principle: EL POBLADO SA, as the person responsible for the processing of personal data, will adopt the physical, technological and/or administrative security measures that are necessary to guarantee the attributes of integrity, authenticity and reliability of personal data. EL POBLADO SA, according to the classification of personal data, will implement high, medium or low level security measures, applicable as the case may be, in order to avoid adulteration, loss, leakage, consultation, use or unauthorized or fraudulent access.
10. Principle of confidentiality: EL POBLADO SA and all persons involved in the processing of personal data have a professional obligation to keep and maintain the confidentiality of such data, an obligation that remains even after the contractual relationship has ended. EL POBLADO SA will implement, in its contractual relations, data protection clauses in this sense.
11. Principle of duty of information: EL POBLADO SA will inform the holders of the personal data, as well as those responsible and in charge of the treatment, of the personal data protection regime adopted by EL POBLADO SA, as well as the purpose and other principles that regulate the treatment. Likewise, it will inform about the existence of the personal databases that it guards, the rights and the exercise of habeas data by the owners, proceeding to the registration required by law.
12. Principle of special protection for sensitive data: EL POBLADO SA will not collect or process personal data exclusively linked to political ideologies, union affiliation, religious beliefs, sexual life, ethnic origin, and health data, unless expressly authorized by the owner, making it clear that it is optional to answer questions regarding sensitive data or about minors, and in those cases of law in which consent is not required. Personal data of a sensitive nature that may be obtained in processes of the activity of EL POBLADO SA will be protected through high security measures.

7. PROCESSING OF PERSONAL DATA

For the purposes of this document, treatment is understood to be any operation or set of operations on personal data, such as collection, storage, use, circulation or deletion, among others.

7.1. COLLECTION OF PERSONAL DATA

7.1.1. Authorization for the processing of personal data.

Any collection and/or collection of personal data carried out by EL POBLADO SA in the development of its commercial, labor and/or contractual activities requires that the holders of the information grant free, prior, express, unequivocal and informed consent, for such situation, EL POBLADO SA has made available to the holders the authorization for the processing of their personal data in the various scenarios in which the organization carries out data collection, either physically or digitally, through authorization models or privacy notices where the owner is informed about the collection of their personal data, the treatment to which they will be submitted, including the purposes, their rights, the channels for exercising their rights and related information on the Personal Data Treatment Policy .

Obtaining authorization for the processing of personal data will be carried out under the different modalities established by law, taking into account the nature of each of the information capture channels, and the way in which it is obtained, that is, , if it is through a written channel, a verbal one or through an unequivocal conduct.

7.1.2. Cases in which authorization is not required

The Owner's authorization will not be necessary in the case of:

• Information required by the Entity, in the exercise of its legal functions or by court order.
• Data of a public nature.
• Cases of medical or health urgency.
• Treatment of information authorized by law for historical, statistical or scientific purposes.
• Data related to the Civil Registry of People.

When EL POBLADO SA accesses personal data without prior authorization, it must in any case comply with the provisions contained in Law 1581 of 2012 and other concordant and current regulations.

7.2. USE AND CIRCULATION OF PERSONAL DATA

The personal information contained in the databases of EL POBLADO SA must be used and processed in accordance with the purposes described in section 7.5. of this policy.

In the event that any area identifies new uses other than those described in this personal data processing policy, it must inform the Legal Department, who will evaluate and manage, when applicable, its inclusion in this document.

Each of the areas of EL POBLADO SA have defined in their corresponding processes, the use and circulation that should be given to personal data in accordance with the purposes and type of data that is collected and processed.

7.3. STORAGE OF PERSONAL DATA

EL POBLADO SA will store the physical and digital information in environments that have adequate controls for data protection, such controls are: human, technological, administrative and environmental. The storage of personal data is backed by procedures and policies provided by each of the areas within the organization that process personal data to guarantee the confidentiality and security of the information.

7.4. DELETION OF PERSONAL DATA

Once the personal data has fulfilled its original purpose and is no longer necessary for processing, it will be safely and appropriately eliminated by EL POBLADO SA

Personal data can be deleted as follows:

1. Electronic removal: Personal data stored electronically will be deleted from all electronic devices, hard drives, servers and any other form of electronic storage in which it is located.
2. Physical removal: Personal data stored on paper or any other physical medium will be destroyed by shredding, incineration, or any other secure disposal method.

In the event that there are legal obligations that prevent the deletion of personal data, it will be blocked, which implies that the data may not be subject to further processing, except for making it available to the competent authorities, in particular the judicial authorities, for the requirement of responsibilities derived from the treatment, and only during the limitation period of these responsibilities. In any case, the confidentiality and security of personal data will be guaranteed, even after its deletion or blocking.

7.5. PURPOSES 

In accordance with Law 1581 of 2012 and other applicable regulations, the personal data processed by EL POBLADO SA will be carried out in accordance with the interest group and in proportion to the purpose (s) of each treatment as classified below:

7.5.1. General purposes of the information

1. For the administrative purposes of EL POBLADO SA
2. Send communications of an administrative, advertising and commercial nature.
3. Send responses to requests, complaints, claims, requests and inquiries from users.
4. Carry out brand positioning campaigns.
5. Carry out virtual and/or face-to-face training.
6. Update databases, including the cases in which it is required to transmit or transfer to a third party the information for the validation, purification, enrichment and homogenization of data, prior compliance with legal requirements.
7. Inform about the products and services of EL POBLADO SA and the innovations made to them.
8. make transactions
9. accounting records
10. Make reports with the different national administrative control and surveillance authorities, police or judicial authorities, financial entities and/or insurance companies.
11. Internal administrative and/or commercial purposes such as: market research, audits, accounting reports, statistical analysis or billing.
12. Transmission and/or transfer to third countries of the data provided, for the execution of activities related to the services and products offered by EL POBLADO SA
13. Identification of fraud and prevention of money laundering and other criminal activities.
14. In the case of biometric data captured through video surveillance or recording systems, their treatment will have the purpose of identification, security and the prevention of internal and external fraud.
15. Prepare surveys, studies, statistics.

7.5.2. Purposes of shareholder information.

1. Make the payment of dividends.
2. Compliance with judicial decisions and administrative and legal provisions.
3. Control of the shareholding and publication of the shareholders with the greatest participation.
4. Compliance with judicial decisions and administrative and legal, fiscal and regulatory provisions

7.5.3. Purposes of customer information.

1. For commercial purposes.
2. To enter into promise of sale and/or purchase contracts.
3. Publicity and marketing.
4. Accounting.
5. Billing
6. Compliance with contractual obligations, for which the information may be transferred to third parties, such as financial institutions, notaries, lawyers, etc.
7. Compliance with judicial decisions and administrative and legal, fiscal and regulatory provisions.
8. Transmission of information and personal data in audit processes.
9. Carry out validation of information from counterparties in the systems against money laundering, financing of terrorism, corruption and transnational bribery.
10. loyalty activities
11. Brand and product positioning.
12. Updating of information.
13. portfolio management

7.5.4. Purposes of supplier and contractor information.

1. To make contracts, documents and/or agreement between the parties.
2. For commercial purposes.
3. Accounting.
4. Compliance with judicial decisions and administrative and legal, fiscal and regulatory provisions.
5. Compliance with contractual obligations, for which the information may be transferred to third parties, such as financial institutions, notaries, lawyers, etc.
6. To carry out the processes in which the suppliers are linked.
7. Any other use that the provider authorizes in writing for the use of your information.
8. Transmission of information and personal data in audit processes.
9. Carry out validation of information from counterparties in the systems against money laundering, financing of terrorism, corruption and transnational bribery.
10. Updating of information.

7.5.5. Information purposes of candidates for a position, employees and former employees.

1. For purposes pertinent to the employment relationship (EPS, ARL, pension and severance funds, family compensation funds, etc.)
2. To meet judicial and legal requirements.
3. Accounting and payment of payroll.
4. Recruit and select personnel that will fill the vacancies.
5. Process, confirm and comply with legal and extralegal labor obligations derived from the labor contract.
6. Make transactions.
7. Payment of extralegal benefits.
8.  
9. Statistical analysis.
10. Training and education
11. Sharing personal data with banks, companies that offer benefits to active workers, among others.
12. Transmission of information and personal data in personnel selection processes through temporary service companies
13. Carry out validation of information from counterparties in the systems against money laundering, financing of terrorism, corruption and transnational bribery.
14. Updating of information.
15. Work accidents.
16. Entrance and withdrawal medical examinations.
17. Access control to the facilities of EL POBLADO SA

8. DATA WITH SPECIAL CONNATION

8.1. SENSITIVE DATA

8.1.1. Treatment of sensitive data

EL POBLADO SA prohibits the processing of sensitive data, except when:

I. The Holder has given his explicit authorization to said treatment, except in cases where the granting of said authorization is not required by law.

II. The treatment is necessary to safeguard the vital interest of the owner and he is physically or legally incapacitated. In these events, the legal representatives must grant their authorization.

III. The treatment refers to data that is necessary for the recognition, exercise or defense of a right in a judicial process.

IV. The treatment has a historical, statistical or scientific purpose. In this event, the measures leading to the suppression of the identity of the Holders must be adopted.

8.1.2. Special authorization of sensitive personal data

EL POBLADO SA complies with the following obligations:

1. Inform the owners of sensitive data, through the various means of obtaining authorization, that by virtue of Law 1581 of 2012 and regulatory standards they are not required to grant authorization for the processing of sensitive data.
2. Inform the owners of the sensitive data explicitly and previously, in addition to the general requirements for the authorization for the collection of any type of personal data, which data subject to Treatment are of a sensitive nature and the purpose of the treatment, and obtain the express consent.
3. Not condition any activity to the owner providing sensitive personal data (unless there is a legal or contractual cause to do so).

8.2. PERSONAL DATA OF CHILDREN AND ADOLESCENTS

EL POBLADO SA only processes personal data of children and adolescents when they are of a public nature or come from the information provided at the time of a labor relationship or as a client, by entering into contracts and/or agreements when they are minors represented by their parents or for advertising, marketing or communications matters when they are part of advertising or marketing campaigns, as long as they have the authorization of the legal representative. The foregoing, in accordance with the provisions of article 7 of Law 1581 of 2012 and, when the treatment meets the following parameters and requirements:

• That responds and respects the best interests of children and adolescents.
• That the respect of their fundamental rights is ensured.

8.2.1. Special authorization of personal data of children and adolescents

EL POBLADO SA complies with the following obligations:

1. Request authorization for the treatment of the data of children and adolescents from the legal representative or guardian of the child or adolescent, the authorization of the minor, prior to the minor giving his opinion regarding the treatment that will be given to his data , opinion that will be valued taking into account maturity, autonomy and ability to understand the matter, as indicated by the Law.
2. Comply with the appropriate use for the authorized purposes.
3. That the respect and guarantee of their fundamental rights be ensured.

9. TRANSMISSION AND TRANSFER OF PERSONAL DATA

EL POBLADO SA may transmit and transfer personal data to third parties with whom it has a commercial, contractual, labor and/or administrative relationship that provide it with the necessary services for its proper operation, in accordance with the functions established by law. The transmission and/or transfer of personal data carried out by EL POBLADO SA must have the prior, express, informed and unequivocal consent of the data owner.

EL POBLADO SA and the person in charge will adopt the necessary measures so that the people who have access to personal data comply with this Policy and with the principles of protection of personal data and obligations established in the Law.

When EL POBLADO SA transmits personal data to managers located inside or outside Colombia, it will enter into a contract for the transmission of personal data that includes clauses that guarantee the protection of the personal data transmitted. The Manager will undertake to apply the obligations of EL POBLADO SA as responsible, under this policy and to carry out the Data Processing in accordance with the purpose that the Holders have authorized and with the applicable laws in force.

9.1. INTERNATIONAL TRANSMISSIONS AND TRANSFERS OF PERSONAL DATA

EL POBLADO SA may carry out transmissions and/or international transfers to managers who have the legal and technical capacity to guarantee the protection and security of the personal data transmitted and/or transferred; Likewise, the transmission and/or transfer of personal data can only be carried out to countries that offer an adequate level of security in the protection of personal data, in accordance with the Single Circular of the Superintendence of Industry and Commerce.

10. DUTIES AND RIGHTS

As established by current regulations, the following are the duties and rights of those involved in the processing of personal data:

10.1. RIGHTS OF PERSONAL DATA HOLDERS

EL POBLADO SA will carry out the processing of personal data under the standards of respect and subject to the rights of the owners established in Law 1581 of 2012, and in application of the provisions of article 8 of the same norm, the owner of personal data will have the following rights:

1. Know, update and rectify your personal data in front of those responsible for the Treatment or Treatment Managers. This right may be exercised, among others, against partial, inaccurate, incomplete, fractioned, misleading data, or those whose Treatment is expressly prohibited or has not been authorized.
2. Request proof of the authorization granted to the person responsible for Treatment except when expressly excepted as a requirement for Treatment, in accordance with the provisions of the law.
3. To be informed by the person in charge of the treatment or the person in charge of the treatment, upon request, regarding the use that has been given to your personal data.
4. Submit to the competent authority complaints for violations of the provisions of the law and other regulations that modify, add or complement it.
5. Revoke the authorization and/or request the deletion of the data when the principles, rights and constitutional and legal guarantees are not respected in the treatment. The revocation and/or deletion will proceed when the respective administrative authority has determined that in the treatment the person in charge or in charge has incurred in conduct contrary to the law and the Constitution.
6. Free access to your personal data that have been processed.

10.2. DUTIES OF THE RESPONSIBLE

EL POBLADO SA, as the person responsible for the processing of personal data, must comply with the following duties, without prejudice to the other provisions provided by law and others that govern its activity:

1. Guarantee the owner, at all times, the full exercise of the right of habeas data.
2. Request and keep, under the conditions provided in this law, a copy of the respective authorization and consent granted by the owner.
3. Duly inform the owner about the purpose of the collection and the rights that assist him by virtue of the authorization granted.
4. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
5. Guarantee that the information provided to the person in charge of the treatment is true, complete, exact, updated, verifiable and understandable.
6. Update the information, communicating in a timely manner to the person in charge of the treatment, all the news regarding the data that has previously been provided and adopt the other necessary measures so that the information is kept updated.
7. Rectify the information when it is incorrect and communicate it to the person in charge of the treatment.
8. Provide the person in charge of the treatment, as the case may be, only data whose treatment is previously authorized in accordance with the provisions of the law.
9. Require the person in charge of the treatment at all times, respect for the security and privacy conditions of the owner's information.
10. Process inquiries and claims in the terms indicated in this standard and in the law.
11. Adopt internal guidelines for policies and procedures to guarantee adequate compliance with the law and, in particular, for the attention of queries and claims.
12. Inform the person in charge of the treatment of the circumstance that certain information is under discussion by the Holder, once the claim has been filed and the respective procedure has not been completed.
13. Inform at the request of the owner about the use given to their data.
14. Inform the data protection authority when there are violations of the security codes and there are risks in the administration of the information of the holders.
15. Comply with the instructions and requirements issued by the competent authority.

10.3. DUTIES OF THE MANAGERS

Those in charge of the processing of personal data must comply with the following duties, without prejudice to the other provisions provided for in the law and others that govern their activity:

1. Guarantee the owner, at all times, the full and effective exercise of the right of habeas data.
2. Keep the information under the necessary security conditions to prevent its adulteration, loss, consultation, use or unauthorized or fraudulent access.
3. Timely update, rectify or delete data under the terms of the law.
4. Update the information reported by those responsible for treatment within five (5) business days from its receipt.
5. Process the queries and claims made by the owners in the terms indicated in this standard and in the law.
6. Adopt internal guidelines for policies and procedures to guarantee adequate compliance with the law and, in particular, for the attention of queries and claims.
7. Register in the database the legend "claim in process" in the manner in which it is regulated by law, with respect to those complaints or unresolved claims presented by the owners of the personal data.
8. Insert in the database the legend "information under judicial discussion" once notified by the competent authority about judicial processes related to the quality of personal data.
9. Refrain from circulating information that is being controversial by the owner and whose blocking has been ordered by the competent authority.
10. Allow access to information only to people who may have access to it.
11. Inform the competent authority when there are violations of the security codes and there are risks in the administration of the information of the holders.
12. Comply with the instructions and requirements issued by the competent authority.

11. SERVICE CHANNELS FOR DATA HOLDERS

EL POBLADO SA has the following mechanisms and/or channels for the attention of the holders of personal data who wish to file requests, complaints, claims, suggestions and queries:

• Web page: elpobladosa.com
• Email: Servicioalcliente@elpobladosa.com
• Face-to-face: Career. 49 No. 75 – 83, Barranquilla – Atlantic.

11.1. AREA RESPONSIBLE FOR ATTENTION OF PQRS AND CONSULTATIONS

The area responsible for the attention, management and response of PQRS and queries in EL POBLADO SA is Customer Service, which centralizes the entire process, in accordance with the Procedure for treatment of PQRS

12. PROCEDURE FOR THE EXERCISE OF RIGHTS

In development of the constitutional guarantee of Habeas Data regarding the rights of access, updating, rectification, cancellation and opposition by the owner, or legally authorized interested party, that is, their successors in title and legal representatives, EL POBLADO SA adopts the following procedure:

12.1. CONSULTATION PROCEDURE

The holders of personal data and their successors in title may consult the information that it holds in the databases managed by EL POBLADO SA, for this, the holders must prove their identity in the following way:

12.1.1. Information required for inquiries

Queries addressed to EL POBLADO SA must contain at least the following information:

1. Names and surnames of the Holder and/or his representative and/or successors in title.
2. Identity document number of the Holder and/or his representative and/or successors in title.
3. Physical, electronic address and telephone to be able to make the respective notifications.
4. What is intended to be consulted.
5. Identity accreditation support.
6. Having been presented by the service channels authorized by EL POBLADO SA

Once Customer Service receives the request for information through any of the service channels enabled by EL POBLADO SA, it will proceed to review the individual record that corresponds to the Holder's name and the identity document number provided, if it finds any difference between These two data will be reported to the user within five (5) business days following receipt, in order for the user to clarify it.

12.1.2. response times

Requests received through any of the service channels enabled by EL POBLADO SA, will be attended to within a maximum term of ten (10) business days from the date of receipt.

In the event that EL POBLADO SA considers that it requires more time to respond to the query, the user will be informed before the expiration of ten (10) business days, the reasons for the delay and indicating the date on which will send the response to your query, which may not exceed five (5) business days after the expiration of the first term.

12.2. PROCEDURE FOR CLAIMS, REQUESTS, COMPLAINTS AND SUGGESTIONS

12.2.1. claims

The holders of personal data and their successors in title who consider that the information contained in a database managed by EL POBLADO SA should be subject to correction, updating or deletion, or if they notice a breach by it or one of its managers, may present the corresponding claim to EL POBLADO SA or the person in charge, for this, the holders must prove their identity in the following way:

12.2.1.1. Information Required for Claims

Claims made to EL POBLADO SA must be in the following terms and must contain at least the following information:

1. The claim will be presented to EL POBLADO SA or the person in charge of the treatment, accompanied by the document that accredits the owner.
2. Names and surnames of the Holder and/or his representative and/or successors in title.
3. Identity document of the Holder and/or his representative and/or successors in title.
4. The clear description of the facts that give rise to the claim.
5. The physical or electronic address where you wish to receive notifications.
6. Contact telephone number of the Holder and/or his assigns or representatives;
7. Documents that you intend to enforce.
8. Having been presented by the service channels authorized by EL POBLADO SA

NOTE:

1. If the claim is incomplete, Customer Service will notify the user, requiring that they correct the claim within five (5) days of receipt of the claim.

2. If after two (2) months from the date on which EL POBLADO SA, head of Customer Service, required the user to correct the claim, the user has not completed or corrected the information, it will be understood that the user has withdrawn the claim. .

3. In the event that EL POBLADO SA, at the head of Customer Service or the person in charge to whom the claim is addressed is not competent to resolve it, it will notify the appropriate person within a maximum term of two (2) business days and inform of the situation to the user; If EL POBLADO SA does not know the person to whom the transfer must be made, Customer Service will immediately inform the owner with a copy to the Superintendency of Industry and Commerce.

4. Once the complete claim has been received, within a maximum term of two (2) business days from receipt, EL POBLADO SA, at the head of customer service, must include in the database where the personal data of the owner are located, a legend that says "Claim in process" and the reason for it. Said legend must be maintained until the claim is decided.

12.2.1.2. Complaint response period

Claims received through any of the service channels enabled by EL POBLADO SA, will be attended to within a maximum term of fifteen (15) business days from the day following the date of receipt, if it is not possible to do so within this term. , Customer Service will inform the user of the reasons for the delay and the date on which the claim will be answered, which may not exceed eight (8) business days following the expiration of the first term.

In the event that the deletion or revocation of the authorization for the use of personal data for any non-essential purpose is appropriate, EL POBLADO SA will carry out the deletion in such a way that the deletion does not allow the recovery of the information, however, the owner You must take into account that in some cases certain information must remain in historical records due to compliance with the legal duties of the organization, so its deletion will be related to the active treatment of the same and according to the request of the owner.

NOTE:

1. EL POBLADO SA may revoke consent in full, in relation to all authorized purposes and if it proceeds, any data processing activity must cease.
2. EL POBLADO SA may partially revoke consent, in relation to some authorized purposes; and personal data may continue to be processed for the purposes of the contractual, commercial or employment relationship.

12.2.2. Requests, complaints and suggestions

The holders of personal data, their successors in title and in general any user, may file requests, complaints and suggestions through the service channels provided by EL POBLADO SA

12.2.2.1. Information required for requests, complaints and suggestions

Requests, complaints and suggestions made to EL POBLADO SA must be in the following terms and must contain at least the following information:

1. Names and surnames of the user.
2. User identity document.
3. The physical or electronic address where you wish to receive notifications.
4. Contact telephone number of the user.
5. The clear description of the facts that give rise to the request, complaint and/or suggestion.
6. Reasons on which the request, complaint and/or suggestion is based.
7. Documents that you intend to enforce.
8. Having been presented by the service channels authorized by EL POBLADO SA

• Deadlines for response to requests, complaints and suggestions.

Special requests, that is to say where documents and information are requested, must be resolved within ten (10) business days following the date of receipt of the request.

General requests, complaints and suggestions received through any of the service channels enabled by EL POBLADO SA, will be dealt with within a maximum term of fifteen (15) business days from the day following the date of receipt, if it is not possible to do so in this term, Customer Service will inform the user of the reasons for the delay and the date on which the claim will be answered, which may not exceed fifteen (15) business days following the expiration of the first term.

13. DATABASES

13.1. CENTRAL REGISTRY OF DATABASES

EL POBLADO SA, as responsible for the processing of personal data in its custody, in the development of its business activity, will have a central registry in which it will list each of the databases contained in its information systems. The central registry of personal databases will allow:

1. Register all personal databases contained in the information systems of EL POBLADO SA, each database will be assigned a registration number. The registration of personal databases will indicate:

• The type of personal data it contains.
• The purpose and intended use of the database.
• Identification of the area of EL POBLADO SA that processes the database.
• Treatment system used (automated or manual) in the database.
• Indication of the level and security measures that apply to the database by virtue of the type of personal data it contains.
• Location of the database in the information systems of EL POBLADO SA
• EL POBLADO SA official who has access to the database.
• The other requirements that are applicable according to the regulation of the law that will be issued.

2. The cancellation of the personal data database will be registered indicating the reasons and the technical measures adopted by EL POBLADO SA to make the cancellation effective.

3. For compliance and auditing purposes, the changes in the databases in relation to the aforementioned requirements will be updated periodically. In the event that the databases have not undergone changes, this will be recorded.

4. The history of security incidents arising from any of the personal databases guarded by EL POBLADO SA will be documented, as well as the sanctions imposed or the measures taken.

13.2. NATIONAL REGISTRY OF DATABASES

In accordance with article 25 of Law 1581 of 2012 and its regulatory decrees, EL POBLADO SA will register its databases together with this personal data processing policy, in the National Registry of Databases administered by the Superintendence of Industry and Commerce, following the procedure established for this.

13.2.1. Identification of the databases

EL POBLADO SA has identified the following databases:

• Customers
• Potential customers
• Clients legal portfolio
• Owner Clients
• Suppliers
• Supplier contracts
• General contract basis
• Control of medical examinations and follow-up
• Absenteeism for medical reasons
• access control log
• Employees
• Former employees
• Intranet
• PQRS

13.3. DATABASE VALIDITY PERIOD

The databases of EL POBLADO SA will have the period of validity that corresponds to the purpose for which their treatment was authorized and the special regulations that regulate the matter.

14. SECURITY MEASURES AND INCIDENT MANAGEMENT

In the processing of personal data regulated in this regulation, EL POBLADO SA will adopt physical, logical and administrative security measures, which are classified as high, medium and low, according to the risk that may arise from the criticality of the data. processed personal data.

The recipients of this policy are obliged to inform EL POBLADO SA of any violation of the security measures adopted by EL POBLADO SA to protect personal data, as well as any inappropriate treatment of information. In these cases, EL POBLADO SA will communicate the situation to the competent authority and will proceed to manage security incidents related to personal data to establish criminal, labor, disciplinary or civil repercussions.

For this, EL POBLADO SA established an internal security incident management procedure, which will be disclosed and will be mandatory for all employees and managers of EL POBLADO SA

14.1. INCIDENT REPORT TO THE SIC

EL POBLADO SA will report all security incidents that affect its databases to the competent authority in this case: Superintendence of Industry and Commerce. Pursuant to Chapter II, Title V of the Single Circular of the Superintendence of Industry and Commerce, organizations that are required to register Personal Databases with the National Registry of Databases must report any security incident within within 15 business days from the moment they are detected and brought to the attention of the person or area in charge of dealing with them.

15. DELIVERY OF PERSONAL DATA TO AUTHORITIES

When the State authorities request EL POBLADO SA access and/or delivery of personal data contained in any of its databases, the legality of the request will be verified, as well as the relevance of the data requested in relation to the purpose expressed by the authority, and the delivery of the requested personal information will be documented, providing that it meets all its attributes (authenticity, reliability and integrity), and noting the duty to protect this data, both to the official making the request, to whom it receives, as well as the entity for which they work. The authority that requires personal information will be warned about the security measures that apply to the personal data delivered and the risks involved in its improper use and inappropriate treatment.

16. SANCTIONS

Failure to comply with this policy will constitute a violation of the employment, civil and/or commercial contract with EL POBLADO SA and will entail the application of sanctions that may even imply the termination of the employment, contractual and/or commercial relationship. Additionally, it may imply sanctions imposed by the competent authorities, according to the applicable regulations.

The notification of any investigative procedure by any authority, related to the processing of personal data, must be immediately communicated to the Legal Department, in order to take the measures tending to defend the actions of the entity and avoid the imposition of the sanctions provided for in the applicable legislation.

17. VALIDITY, VERSIONS AND UPDATE OF THE POLICY

This personal data processing policy is in force as of March 30, 2023, and complements the associated policies, it will be in force until the moment it is expressly revoked or modified.

The modifications made to the policies described here will give rise to a new version of the document; Likewise, the owners of the data will be notified in a timely manner through the usual means of contact and/or through the website: www.elpobladosa.com